Page view anomaly detection method and device, electronic equipment and storage medium

Abstract

The invention provides a page view anomaly detection method and device, electronic equipment and a storage medium, and the method comprises the steps: determining a first page view of a resource locator URL of each page in application software in a first time period, and after determining that a target URL of which the first page view is greater than a page view threshold exists in the URL, determining that the page view is greater than the page view threshold; and determining an average value of the page view in combination with a second page view of the target URL in a second time period before the first time period and the duration of the second time period, and determining whether the page view of the target URL is abnormal in the first time period according to the average value of the page view and a first page view of the target URL in the first time period. Therefore, whether the page view anomaly occurs in the target URL in the first time period or not is determined by combining the page view of the target URL in the first time period and the page view of the target URL in the second time period before the first time period, and the page view anomaly detection accuracy is improved.

Description

Technical Field

[0001] This application relates to the field of computer technologies, and in particular, to a method, apparatus, electronic device, and storage medium for detecting abnormal access volumes. Background Art

[0002] During the operation of application software, to ensure the healthy and stable operation of the application software, it is usually necessary to determine whether there is an abnormal access volume for the Uniform Resource Locator (URL) of each page in the application software, and in the case of an abnormal access volume, output a warning message so that the corresponding personnel can perform subsequent processing based on the warning message to ensure the healthy and stable operation of the application software.

[0003] In related technologies, usually, the access volume of a corresponding URL in a specified time period is directly compared with a preset access volume threshold, and in the case where the comparison result indicates that the access volume exceeds the preset access volume threshold, it is directly determined that the URL has an abnormal access volume. However, this method for detecting abnormal access volumes is not accurate enough, and it may misjudge the sudden increase in traffic caused by a normal large promotion as an abnormal access volume, resulting in false alarms for abnormal access volumes. Summary of the Invention

[0004] This application provides a method, apparatus, electronic device, and storage medium for detecting abnormal access volumes.

[0005] In one aspect of the embodiments of this application, a method for detecting abnormal access volumes is provided. The method includes: determining a first access volume of the Uniform Resource Locator (URL) of each page in the application software in a first time period; in the case where the first access volume of a target URL in the first time period is greater than the access volume threshold of the target URL among multiple URLs, obtaining a second access volume of the target URL in a second time period, where the second time period is a time period before the first time period; determining an average access volume according to the duration of the second time period and the second access volume; and determining whether there is an abnormal access volume of the target URL in the first time period according to the average access volume and the first access volume of the target URL in the first time period.

[0006] The access volume anomaly detection method according to an embodiment of the present application determines the first access volume of the resource locator URL (Uniform Resource Locator) of each page in the application software within the first time period. After determining that there is a target URL in the URL whose first access volume is greater than the access volume threshold, the method combines the second access volume of the target URL in the second time period before the first time period and the duration of the second time period to determine the average access volume, and determines whether there is an access volume anomaly of the target URL within the first time period according to the average access volume and the first access volume of the target URL within the first time period. Thus, by combining the access volume of the target URL in the first time period and the second time period before the first time period, it is determined whether there is an access volume anomaly of the target URL within the first time period, improving the accuracy of access volume anomaly detection.

[0007] Another embodiment of the present application provides an access volume anomaly detection device, including: a first determination module, configured to determine the first access volume of the resource locator URL (Uniform Resource Locator) of each page in the application software within the first time period; an acquisition module, configured to, when the first access volume of a target URL in a plurality of the URLs is greater than the access volume threshold of the target URL, acquire the second access volume of the target URL in the second time period, where the second time period is a time period before the first time period; a second determination module, configured to determine the average access volume according to the duration of the second time period and the second access volume; and a third determination module, configured to determine whether there is an access volume anomaly of the target URL within the first time period according to the average access volume and the first access volume of the target URL within the first time period.

[0008] The access volume anomaly detection device according to an embodiment of the present application determines the first access volume of the resource locator URL (Uniform Resource Locator) of each page in the application software within the first time period. After determining that there is a target URL in the URL whose first access volume is greater than the access volume threshold, the method combines the second access volume of the target URL in the second time period before the first time period and the duration of the second time period to determine the average access volume, and determines whether there is an access volume anomaly of the target URL within the first time period according to the average access volume and the first access volume of the target URL within the first time period. Thus, by combining the access volume of the target URL in the first time period and the second time period before the first time period, it is determined whether there is an access volume anomaly of the target URL within the first time period, improving the accuracy of access volume anomaly detection.

[0009] Another embodiment of the present application provides an electronic device, including: a memory, a processor, and a computer program stored on the memory and executable on the processor, where the processor implements the access volume anomaly detection method according to the embodiment of the present application when executing the computer program.

[0010] In another embodiment of the present application, a computer-readable storage medium is proposed, on which a computer program is stored. When the computer program is executed by a processor, the method for detecting abnormal access volume disclosed in the embodiments of the present application is implemented.

[0011] In another embodiment of the present application, a computer program product is proposed. When the instructions in the computer program product are executed by a processor, the method for detecting abnormal access volume in the embodiments of the present application is implemented.

[0012] Other effects of the above optional methods will be described in conjunction with specific embodiments below. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] The drawings are used to better understand the solution and do not constitute a limitation to the present application. Among them:

[0014] Figure 1 is a schematic flowchart of a method for detecting abnormal access volume according to an embodiment of the present application.

[0015] Figure 2 is a schematic flowchart of a method for detecting abnormal access volume according to another embodiment of the present application.

[0016] Figure 3 is a schematic flowchart of a method for detecting abnormal access volume according to another embodiment of the present application.

[0017] Figure 4 is a schematic structural diagram of a device for detecting abnormal access volume according to an embodiment of the present application.

[0018] Figure 5 is a block diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0019] The embodiments of the present invention will be described in detail below. The examples of the embodiments are shown in the drawings, where the same or similar reference numerals denote the same or similar elements or elements with the same or similar functions throughout. The embodiments described below with reference to the drawings are exemplary and are intended to explain the present application and should not be construed as a limitation to the present application.

[0020] The method, device, electronic device, and storage medium for detecting abnormal access volume according to the embodiments of the present application will be described below with reference to the drawings.

[0021] Figure 1It is a flowchart of a method for detecting abnormal access volume according to an embodiment of the present application. It should be noted that the execution subject of the method for detecting abnormal access volume provided in this embodiment is an access volume abnormal detection device, which can be implemented in software and / or hardware. In this embodiment, the access volume abnormal detection device can be an electronic device or can be configured in an electronic device so that the electronic device has the function of detecting abnormal access volume.

[0022] Among them, the electronic device in this embodiment may include, but is not limited to, devices such as terminal devices and servers, and this embodiment does not specifically limit the electronic device.

[0023] As Figure 1 shown, the method for detecting abnormal access volume may include:

[0024] Step 101, determine the first access volume of the resource locator URL (Uniform Resource Locator) of each page in the application software in the first time period.

[0025] Among them, the application software refers to software that provides specific functions, services, or operations for users. For example, the application software may include desktop clients, mobile applications, Web applications, websites, and other software specifically designed to complete specific tasks.

[0026] Among them, the duration of the first time period in this embodiment may be a preset duration. For example, the preset duration may be 1 minute, 2 minutes, 3 minutes, etc., and the value of the preset duration can be set according to actual needs. This embodiment does not specifically limit the preset duration.

[0027] In some embodiments, the URL access log of the application software in the first time period can be obtained; according to the URL access log, the first access volume of each URL in the first time period is determined.

[0028] In this embodiment, the number of accesses of the URLs of each page in the application software included in the URL access log can be counted to obtain the first access volume of each URL in the first time period.

[0029] In some embodiments, in order to improve the accuracy of the first access volume of each URL determined in the first time period, before determining the first access volume of each URL according to the URL access log, the URL access log can also be preprocessed. Among them, the preprocessing may include data cleaning and formatting, etc. For example, invalid URLs can be removed, and parameters irrelevant to determining the access volume can be filtered out, etc., to filter out the noise in the URL access log and improve the accuracy of the access volume determined subsequently.

[0030] Step 102, among multiple URLs, when the first traffic volume of the target URL in the first time period is greater than the traffic volume threshold of the target URL, obtain the second traffic volume of the target URL in the second time period, where the second time period is a time period before the first time period.

[0031] In some embodiments, the second time period and the first time period may be consecutive. That is to say, the second time period may be a time period before the first time period and consecutive with the first time period.

[0032] Among them, in this embodiment, a URL with a traffic volume greater than the traffic volume threshold is called a log URL.

[0033] In some embodiments, in order to further improve the accuracy of the determined target URL, correspondingly, for each URL, it can be determined whether the first traffic volume of the URL in the first time period is greater than the traffic volume threshold corresponding to the URL. If it is greater, then determine the URL as the target URL.

[0034] It should be noted that the traffic volume threshold corresponding to the URL can be determined according to the historical traffic volume data of the URL.

[0035] Step 103, determine the average traffic volume according to the duration of the second time period and the second traffic volume.

[0036] In some embodiments, the second traffic volume can be divided by the duration of the second time period to obtain the average traffic volume.

[0037] Step 104, determine whether there is an abnormal traffic volume of the target URL in the first time period according to the average traffic volume and the first traffic volume of the target URL in the first time period.

[0038] It should be noted that, in different scenarios, the implementation manner of step 104 is different. Examples are as follows:

[0039] As an example of the implementation manner, the traffic volume difference between the average traffic volume and the first traffic volume of the target URL in the first time period can be determined, and by judging whether the traffic volume difference is within a preset range, it is determined whether there is an abnormal traffic volume of the target URL in the first time period.

[0040] In some embodiments, when the traffic volume difference is within the preset range, it is determined that there is no abnormal traffic volume of the target URL in the first time period, that is, it is determined that the target URL is normal in the first time period.

[0041] In some other embodiments, when the traffic volume difference is not within the preset range, it can be determined that there is an abnormal traffic volume of the target URL in the first time period.

[0042] As another example implementation, determine the ratio of the first access volume of the target URL in the first time period to the average access volume, compare this ratio with the first ratio threshold and the second ratio threshold respectively, and determine whether there is an abnormal access volume of the target URL in the first time period according to the comparison result.

[0043] Among them, the first ratio threshold is a number greater than 1.

[0044] Among them, the second ratio threshold is a number greater than 0 and less than 1.

[0045] It should be noted that the above first ratio threshold and second ratio threshold are preset according to actual needs, and this embodiment does not specifically limit the first ratio threshold and the second ratio threshold.

[0046] In some embodiments, when the comparison result is that the ratio is greater than the first ratio threshold, or the ratio is less than the second ratio threshold, it is determined that there is an abnormal access volume of the target URL in the first time period.

[0047] For example, the first ratio threshold can be 1.5, and the second ratio threshold can be 0.5. After determining the first access volume pv of the target URL in the first time period and determining the average access volume pv_avg, the ratio can be obtained by dividing the first access volume pv by the average access volume pv_avg, and this ratio is compared with the first ratio threshold and the second ratio threshold. If the ratio is greater than the first ratio threshold, or the ratio is less than the second ratio threshold, it is determined that there is an abnormal access volume of the target URL in the first time period.

[0048] In some other embodiments, when the comparison result is that the ratio is greater than or equal to the second ratio threshold and less than or equal to the first ratio threshold, it is determined that there is no abnormal access volume of the target URL in the first time period, that is, it is determined that the access volume of the target URL in the first time period is normal.

[0049] The access volume anomaly detection method according to the embodiments of the present application determines the first access volume of the resource locator URL (Uniform Resource Locator) of each page in the application software during the first time period. After determining that there is a target URL in the URL whose first access volume is greater than the access volume threshold, the method combines the second access volume and the duration of the second time period of the target URL before the first time period to determine the average access volume, and determines whether there is an access volume anomaly of the target URL during the first time period based on the average access volume and the first access volume of the target URL during the first time period. Thus, by combining the access volume of the target URL during the first time period and the second time period before the first time period, it is determined whether there is an access volume anomaly of the target URL during the first time period, improving the accuracy of access volume anomaly detection.

[0050] Based on the above embodiments, when it is determined that there is an access volume anomaly of the target URL during the first time period according to the average access volume and the first access volume of the target URL during the first time period, an alarm prompt message is output, where the alarm prompt message is used to indicate that there is an access volume anomaly of the target URL during the first time period. Thus, the corresponding personnel can perform subsequent processing according to the alarm prompt message.

[0051] Figure 2 It is a schematic flowchart of the access volume anomaly detection method according to another embodiment of the present application. It should be noted that this embodiment is a further refinement or optimization of the foregoing embodiments.

[0052] As Figure 2 shown, the access volume anomaly detection method may include:

[0053] Step 201, determine the first access volume of the resource locator URL (Uniform Resource Locator) of each page in the application software during the first time period.

[0054] Step 202, when the first access volume of the target URL during the first time period is greater than the access volume threshold of the target URL among multiple URLs, obtain the second access volume of the target URL during the second time period, where the second time period is a time period before the first time period.

[0055] Step 203, determine the average access volume according to the duration of the second time period and the second access volume.

[0056] It should be noted that for the specific implementation manners of steps 201 to 203, reference can be made to the relevant descriptions in other embodiments, which will not be elaborated here.

[0057] Step 204, determine the target access volume interval where the first access volume of the target URL during the first time period is located from multiple preset access volume intervals.

[0058] It should be noted that in this embodiment, among multiple preset traffic volume intervals, the traffic volume interval where the first traffic volume of the target URL in the first time period is located is called the target traffic volume interval.

[0059] Step 205: Obtain the abnormal judgment rule corresponding to the target traffic volume interval.

[0060] Step 206: Determine whether there is an abnormal traffic volume of the target URL in the first time period according to the abnormal judgment rule, the average traffic volume, and the first traffic volume of the target URL in the first time period.

[0061] In some embodiments, the abnormal judgment rule corresponding to the target traffic volume interval includes: a third ratio threshold, and the third ratio threshold is a number greater than 1. Correspondingly, a possible implementation manner for determining whether there is an abnormal traffic volume of the target URL in the first time period according to the abnormal judgment rule, the average traffic volume, and the first traffic volume of the target URL in the first time period is: determine the ratio of the first traffic volume of the target URL in the first time period to the average traffic volume; determine whether there is an abnormal traffic volume of the target URL in the first time period according to the comparison result between this ratio and the third ratio threshold.

[0062] In some other embodiments, when the comparison result is that the ratio is greater than the third ratio threshold, it is determined that there is an abnormal traffic volume of the target URL in the first time period.

[0063] In some other embodiments, when the comparison result is that the ratio is less than or equal to the third ratio threshold, it is determined that the traffic volume of the target URL in the first time period is normal.

[0064] For example, the target traffic volume interval can be from 500 to 1000, or the target traffic volume interval is greater than 1000. The third ratio threshold in the abnormal judgment rule can be 2, and the abnormal judgment rule is used to indicate that when it is determined that the ratio of the first traffic volume of the target URL in the first time period to the average traffic volume is greater than 2, it is determined that there is an abnormal traffic volume of the target URL in the first time period.

[0065] For another example, the target traffic volume interval can be from 100 to 500, that is, the first traffic volume is between 100 and 500. The third ratio threshold in the abnormal judgment rule can be 3, and the abnormal judgment rule is used to indicate that when it is determined that the ratio of the first traffic volume of the target URL in the first time period to the average traffic volume is greater than 3, it is determined that there is an abnormal traffic volume of the target URL in the first time period.

[0066] In some embodiments, when the abnormal judgment rule includes, in addition to the third ratio threshold, a first difference threshold, the abnormal judgment rule is used to indicate that when the ratio is greater than the third ratio threshold and the difference between the first access volume of the target URL in the first time period and the average access volume is greater than the first difference threshold, it is determined that there is an abnormal access volume of the target URL in the first time period.

[0067] Among them, the difference between the first access volume of the target URL in the first time period and the average access volume refers to the difference obtained by subtracting the average access volume from the first access volume of the target URL in the first time period.

[0068] For example, the target access volume range is from 50 to 100, that is, the first access volume is between 50 and 100. At this time, the third ratio threshold in the abnormal judgment rule can be 3, and the first difference threshold can be 40. The abnormal judgment rule is used to indicate that when the ratio is greater than 3 and the difference between the first access volume of the target URL in the first time period and the average access volume is greater than 40, it is determined that there is an abnormal access volume of the target URL in the first time period.

[0069] In some embodiments, when the above abnormal judgment rule includes, in addition to the third ratio threshold, a fourth ratio threshold, the abnormal judgment rule is further used to indicate that when the ratio is less than the fourth ratio threshold, it is determined that there is an abnormal access volume of the target URL in the first time period, where the fourth ratio threshold is a number greater than 0 and less than 1.

[0070] For example, the target access volume range can be from 100 to 500, that is, the first access volume is between 100 and 500. The third ratio threshold in the abnormal judgment rule can be 3, and the fourth ratio threshold can be 0.5. Among them, the abnormal judgment rule is used to indicate that when it is determined that the ratio of the first access volume of the target URL in the first time period to the average access volume is greater than 3, or the ratio is less than 0.5, it is determined that there is an abnormal access volume of the target URL in the first time period.

[0071] In other embodiments, when the above abnormal judgment rule includes: a third ratio threshold, a first difference threshold, and a fourth ratio threshold, the abnormal judgment rule is used to indicate that when the ratio is less than the fourth ratio threshold, or when the ratio is greater than the third ratio threshold and the difference between the first access volume of the target URL in the first time period and the average access volume is greater than the first difference threshold, it is determined that there is an abnormal access volume of the target URL in the first time period.

[0072] For example, the target traffic volume range is from 50 to 100, that is, the first traffic volume is between 50 and 100. The third ratio threshold in the abnormal judgment rule can be 3, the fourth ratio threshold can be 0.3, and the first difference threshold can be 40. The abnormal judgment rule is used to indicate that when the ratio is less than 0.3, or when the ratio is greater than 3 and the difference between the first traffic volume of the target URL in the first time period and the average traffic volume is greater than 40, it is determined that there is an abnormal traffic volume of the target URL in the first time period.

[0073] In some other embodiments, the abnormal judgment rule includes: a fourth ratio threshold, and the fourth ratio threshold is a number greater than 0 and less than 1. A possible implementation manner for determining whether there is an abnormal traffic volume of the target URL in the first time period according to the abnormal judgment rule, the average traffic volume, and the first traffic volume of the target URL in the first time period is: determining the ratio of the first traffic volume of the target URL in the first time period to the average traffic volume; and determining that there is an abnormal traffic volume of the target URL in the first time period according to the comparison result between the ratio and the fourth ratio threshold.

[0074] In some embodiments, when the comparison result is that the ratio is less than the fourth ratio threshold, it is determined that there is an abnormal traffic volume of the target URL in the first time period.

[0075] In some other embodiments, when the comparison result is that the ratio is greater than or equal to the fourth ratio threshold, it is determined that the traffic volume of the target URL in the first time period is normal.

[0076] In some embodiments, when the above abnormal judgment rule includes a fourth ratio threshold and a second difference threshold, the abnormal judgment rule is used to indicate that when the ratio is less than the fourth ratio threshold and the difference between the average traffic volume and the first traffic volume of the target URL in the first time period is greater than the second difference threshold, it is determined that there is an abnormal traffic volume of the target URL in the first time period.

[0077] For example, the target traffic volume range is from 0 to 10, that is, the first traffic volume pv of the target URL in the first time period is within the target traffic volume range. The fourth ratio threshold in the abnormal judgment rule can be 0.2, and the second difference threshold can be 20. Correspondingly, the abnormal judgment rule is used to indicate that when the ratio h-flag of the first traffic volume pv to the average traffic volume h is less than 0.2 and the difference between the average traffic volume h and pv is greater than 20, it is determined that there is an abnormal traffic volume of the target URL in the first time period.

[0078] For another example, the target traffic volume range is from 10 to 50, that is, the first traffic volume pv of the target URL in the first time period is within the target traffic volume range. The fourth ratio threshold in the abnormal judgment rule can be 0.3, and the second difference threshold can be 40. Correspondingly, the abnormal judgment rule is used to indicate that when the ratio h-flag of the first traffic volume pv to the average traffic volume h is less than 0.3 and the difference between the average traffic volume h and pv is greater than 40, it is determined that there is an abnormal traffic volume of the target URL in the first time period.

[0079] To clearly understand the present application, the method of this embodiment will be described exemplarily below in conjunction with Figure 3 the method of this embodiment.

[0080] Figure 3 FIG. is a schematic flowchart of a traffic volume anomaly detection method according to another embodiment of the present application. It should be noted that in this embodiment, an application software is taken as an example of the target website for exemplary description.

[0081] As Figure 3 shown, the method may include:

[0082] Step 301, obtain the URL access log of the target website.

[0083] Step 302, preprocess the URL access log.

[0084] In some embodiments, the preprocessing may include data cleaning and formatting, etc. For example, invalid URLs can be removed, and parameters irrelevant to determining the traffic volume can be filtered out. Thus, the noise data in the URL access log is deleted, which helps to improve the accuracy of the traffic volume of each determined URL, and then improve the accuracy and reliability of subsequent traffic volume anomaly detection.

[0085] Step 303, control a first time window of a preset duration to slide on the preprocessed URL access log with a preset step size, and regard the URL access log within the first time window as the URL access log of the target website in the first time period.

[0086] Among them, the preset step size is set according to actual needs. For example, the preset step size can be the same as the size of the first time window.

[0087] It can be understood that in this embodiment, the duration of the first time period and the first time window are the same. For example, the size of the first time window is 1 minute, and correspondingly, the duration of the first time period is 1 minute.

[0088] Step 304, determine the first traffic volume of each web page URL in the target website in the first time period according to the URL access log of the target website in the first time period.

[0089] Step 305, when determining the URL of the target website, if the first access volume of the target URL in the first time period is greater than its corresponding access volume threshold, obtain the first URL access log of the target website in the second time period from the preprocessed URL access log.

[0090] Wherein, the second time period is a time period before the first time period and consecutive with the first time period. For example, the duration of the second time period can be 5 minutes.

[0091] In some embodiments, for any one of multiple URLs, it can be determined whether the first access volume of the URL in the first time period is greater than the access volume threshold corresponding to the URL. If it is greater, the URL is used as the target URL.

[0092] In some embodiments, the first URL access log of the target website in the second time period can be obtained through the second time window.

[0093] Wherein, the duration of the second time window is the same as the duration of the second time period.

[0094] Step 306, determine the second access volume pv-pre of the target URL in the second time period according to the first URL access log.

[0095] Step 307, determine the average access volume h according to the second access volume pv-pre and the duration of the second time period.

[0096] Step 308, determine whether there is an abnormal access volume of the target URL in the first time period according to the first access volume pv of the target URL in the first time period and the average access volume h.

[0097] In some embodiments, based on the month-on-month rule, it can be determined whether there is an abnormal access volume of the target URL in the first time period according to the first access volume pv of the target URL in the first time period and the average access volume h.

[0098] Wherein, the month-on-month rule is used to indicate that when the ratio of the first access volume pv of the target URL in the first time period to the average access volume h is greater than the first ratio threshold, or less than the second ratio threshold, it is determined that there is an abnormal access volume of the target URL in the first time period.

[0099] Wherein, the first ratio threshold is a number greater than 1. For example, the first ratio threshold is 1.5.

[0100] Wherein, the second ratio threshold is a number greater than 0 and less than 1. For example, the second ratio threshold can be 0.5.

[0101] In some other embodiments, based on the month-on-month classification rule, the target traffic volume interval where the first traffic volume pv is located can be determined from multiple preset traffic volume intervals, and whether there is a traffic volume anomaly for the target URL in the first time period can be determined according to the anomaly judgment rule corresponding to the target traffic volume interval, the first traffic volume pv, and the average traffic volume h.

[0102] Among them, an example of the correspondence table between the preset traffic volume intervals and the corresponding anomaly judgment rules is shown in Table 1.

[0103] Table 1 Correspondence table between preset traffic volume intervals and corresponding anomaly judgment rules

[0104]

[0105] Among them, it should be noted that h-flag in Table 1 above represents pv / h, pv represents the first traffic volume of the target URL in the first time period, and h represents the average traffic volume.

[0106] Among them, it should be noted that if the anomaly judgment rule is satisfied, it is determined that there is a traffic volume anomaly for the target URL in the first time period.

[0107] Step 309, in the case of a traffic volume anomaly, output an alarm prompt message, where the alarm prompt message is used to indicate that there is a traffic volume anomaly for the target URL in the first time period.

[0108] In summary, it can be seen that in the case where it is determined that the traffic volume of the corresponding URL in the first time period is greater than the preset traffic volume threshold, by combining the traffic volume of the URL in the second time period before the first time period and the traffic volume in the first time period, it is determined whether there is a traffic volume anomaly for the URL in the first time period, which improves the accuracy of traffic volume anomaly detection, and then reduces the false alarms of traffic volume anomalies.

[0109] Corresponding to the traffic volume anomaly detection methods provided in the above several embodiments, an embodiment of the present application also provides a traffic volume anomaly detection device. Since the traffic volume anomaly detection device provided in the embodiment of the present application corresponds to the traffic volume anomaly detection methods provided in the above several embodiments, the implementation manners of the traffic volume anomaly detection methods are also applicable to the traffic volume anomaly detection device provided in this embodiment, and will not be described in detail in this embodiment.

[0110] Figure 4It is a schematic structural diagram of a device for detecting abnormal access volume according to an embodiment of the present application. It should be noted that the device for detecting abnormal access volume can be implemented in the form of software and / or hardware. In this embodiment, the device for detecting abnormal access volume can be an electronic device or can be configured in an electronic device. The electronic device in this embodiment can include, but is not limited to, devices such as terminal devices and servers, and this embodiment does not specifically limit the electronic device.

[0111] As Figure 4 shown, the access volume abnormal detection device 400 includes:

[0112] A first determination module 401, configured to determine the first access volume of the resource locator URL (Uniform Resource Locator) of each page in the application software in the first time period.

[0113] An acquisition module 402, configured to, when the first access volume of the target URL in the first time period is greater than the access volume threshold of the target URL among multiple URLs, acquire the second access volume of the target URL in the second time period, where the second time period is a time period before the first time period.

[0114] A second determination module 403, configured to determine an average access volume according to the duration of the second time period and the second access volume.

[0115] A third determination module 404, configured to determine whether there is an abnormal access volume of the target URL in the first time period according to the average access volume and the first access volume of the target URL in the first time period.

[0116] In an embodiment of the present application, the first determination module 401 is specifically configured to: acquire the URL access log of the application software in the first time period; determine the first access volume of each URL in the first time period according to the URL access log.

[0117] In an embodiment of the present application, the third determination module 404 is specifically configured to: determine the ratio of the first access volume of the target URL in the first time period to the average access volume; when the ratio is greater than the first ratio threshold or less than the second ratio threshold, determine that there is an abnormal access volume of the target URL in the first time period, where the first ratio threshold is a number greater than 1, and the second ratio threshold is a number greater than 0 and less than 1.

[0118] In an embodiment of the present application, the third determination module 404 is further configured to: when the ratio is greater than or equal to the second ratio threshold and less than or equal to the first ratio threshold, determine that the access volume of the target URL in the first time period is normal.

[0119] In an embodiment of the present application, the third determination module 404 is specifically configured to: determine the target access volume range where the first access volume of the target URL in the first time period is located from multiple preset access volume ranges; obtain the exception determination rule corresponding to the target access volume range; and determine whether there is an abnormal access volume of the target URL in the first time period according to the exception determination rule, the average access volume, and the first access volume of the target URL in the first time period.

[0120] In an embodiment of the present application, the exception determination rule includes: a third ratio threshold, and the third ratio threshold is a number greater than 1. The third determination module 404 is specifically configured to: determine the ratio of the first access volume of the target URL in the first time period to the average access volume; and determine that there is an abnormal access volume of the target URL in the first time period when the ratio is greater than the third ratio threshold.

[0121] In an embodiment of the present application, the third determination module 404 is further configured to: determine that the access volume of the target URL in the first time period is normal when the ratio is less than or equal to the third ratio threshold.

[0122] In an embodiment of the present application, the exception determination rule further includes: a first difference threshold. Wherein, when it is determined that there is an abnormal access volume of the target URL in the first time period when the ratio is greater than the third ratio threshold, it includes: when the ratio is greater than the third ratio threshold and the difference between the first access volume of the target URL in the first time period and the average access volume is greater than the first difference threshold, determine that there is an abnormal access volume of the target URL in the first time period.

[0123] In an embodiment of the present application, the exception determination rule includes: a fourth ratio threshold, and the fourth ratio threshold is a number greater than 0 and less than 1. The third determination module 404 is specifically configured to: determine the ratio of the first access volume of the target URL in the first time period to the average access volume; and determine that there is an abnormal access volume of the target URL in the first time period when the ratio is less than the fourth ratio threshold.

[0124] In an embodiment of the present application, the third determination module 404 is further configured to: determine that the access volume of the target URL in the first time period is normal when the ratio is greater than or equal to the fourth ratio threshold.

[0125] In an embodiment of the present application, the exception determination rule further includes: a second difference threshold. Wherein, when it is determined that there is an abnormal access volume of the target URL in the first time period when the ratio is less than the fourth ratio threshold, it includes: when the ratio is less than the fourth ratio threshold and the difference between the average access volume and the first access volume of the target URL in the first time period is greater than the second difference threshold, determine that there is an abnormal access volume of the target URL in the first time period.

[0126] The access volume anomaly detection device according to the embodiment of the present application determines the first access volume of the resource locator URL (Uniform Resource Locator) of each page in the application software during the first time period, and after determining that there is a target URL in the URL whose first access volume is greater than the access volume threshold, combines the second access volume and the duration of the second time period before the first time period of the target URL to determine the average access volume, and determines whether there is an access volume anomaly of the target URL during the first time period according to the average access volume and the first access volume of the target URL during the first time period. Thus, by combining the access volume of the target URL during the first time period and the second time period before the first time period, it is determined whether there is an access volume anomaly of the target URL during the first time period, improving the accuracy of access volume anomaly detection.

[0127] According to an embodiment of the present application, the present application also provides an electronic device and a readable storage medium.

[0128] Figure 5 is a block diagram of an electronic device according to an embodiment of the present application.

[0129] As Figure 5 shown, the electronic device includes:

[0130] A memory 501, a processor 502, and computer instructions stored on the memory 501 and executable on the processor 502.

[0131] When the processor 502 executes the instructions, it implements the access volume anomaly detection method provided in the above embodiment.

[0132] Further, the electronic device further includes:

[0133] A communication interface 503 for communication between the memory 501 and the processor 502.

[0134] The memory 501 is used to store computer instructions executable on the processor 502.

[0135] The memory 501 may include a high-speed RAM memory, and may also include non-volatile memory, such as at least one disk memory.

[0136] The processor 502 is used to implement the access volume anomaly detection method in the above embodiment when executing the program.

[0137] If the memory 501, the processor 502, and the communication interface 503 are implemented independently, the communication interface 503, the memory 501, and the processor 502 can be interconnected via a bus and communicate with each other. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, an Extended Industry Standard Architecture (EISA) bus, or the like. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 5 it is represented by only a thick line in Figure 5 , but this does not mean that there is only one bus or one type of bus.

[0138] Optionally, in a specific implementation, if the memory 501, the processor 502, and the communication interface 503 are integrated on a single chip, the memory 501, the processor 502, and the communication interface 503 can communicate with each other via an internal interface.

[0139] The processor 502 may be a Central Processing Unit (CPU), or an Application Specific Integrated Circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present application.

[0140] The present application also provides a computer program product, which implements the access volume anomaly detection method of the embodiments of the present application when the instruction processor in the computer program product executes.

[0141] In the description of this specification, the descriptions with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples", etc. mean that the specific features, structures, materials, or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, without contradiction, those skilled in the art can combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples.

[0142] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the quantity of the technical features indicated. Thus, features defined with "first" and "second" may explicitly or implicitly include at least one such feature. In the description of this application, "a plurality of" means at least two, such as two, three, etc., unless otherwise specifically and explicitly defined.

[0143] Any process or method description represented in a flowchart or described otherwise herein may be understood to represent a module, segment, or portion of code including one or more executable instructions for implementing a customized logical function or process. The scope of the preferred embodiments of this application includes additional implementations, where functions may be executed in a substantially simultaneous manner or in a reverse order according to the functions involved, rather than in the order shown or discussed, which should be understood by those skilled in the technical field to which the embodiments of this application pertain.

[0144] The logic and / or steps represented in a flowchart or described otherwise herein, for example, may be considered a sequenced list of executable instructions for implementing a logical function, and may be embodied specifically in any computer-readable medium for use by or in connection with an instruction execution system, apparatus, or device, such as a computer-based system, a system including a processor, or other systems that can fetch and execute instructions from the instruction execution system, apparatus, or device. For the purposes of this specification, a "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of the computer-readable medium include the following: an electrical connection portion having one or more wirings (electronic device), a portable computer diskette (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disc read-only memory (CDROM). Additionally, the computer-readable medium can even be paper or other suitable medium on which a program can be printed, as the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpretation, or other suitable processing as necessary, and then stored in a computer memory.

[0145] It should be understood that each part of the present application can be implemented by hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, any one of the following techniques known in the art or a combination thereof can be used: discrete logic circuits with logic gate circuits for implementing logic functions on data signals, application specific integrated circuits with suitable combinational logic gate circuits, programmable gate arrays (PGAs), field programmable gate arrays (FPGAs), etc.

[0146] Those of ordinary skill in the art can understand that all or part of the steps carried by the method of the above embodiments can be completed by instructing relevant hardware through a program, and the program can be stored in a computer-readable storage medium. When the program is executed, it includes one or a combination of the steps of the method embodiments.

[0147] In addition, in each embodiment of the present application, each functional unit can be integrated in a processing module, or each unit can exist physically alone, or two or more units can be integrated in a module. The above integrated module can be implemented in the form of hardware or in the form of a software functional module. When the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0148] The above-mentioned storage medium can be a read-only memory, a magnetic disk, an optical disc, etc. Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and should not be construed as limiting the present application. Those of ordinary skill in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of the present application.

Claims

1. An abnormal access volume detection method, characterized in that The method includes: Determining the first access volume of the resource locator URL of each page in the application software during a first time period; When the first access volume of the target URL during the first time period is greater than the access volume threshold of the target URL among multiple said URLs, obtaining the second access volume of the target URL during a second time period, where the second time period is a time period before the first time period; Determining an average access volume according to the duration of the second time period and the second access volume; Determining whether there is an abnormal access volume of the target URL during the first time period according to the average access volume and the first access volume of the target URL during the first time period.

2. The method according to claim 1, wherein The determining the first access volume of the resource locator URL of each page in the application software during the first time period includes: Obtaining the URL access log of the application software during the first time period; Determining the first access volume of each said URL during the first time period according to the URL access log.

3. The method according to claim 1, characterized in that, The determining whether there is an abnormal access volume of the target URL during the first time period according to the average access volume and the first access volume of the target URL during the first time period includes: Determining the ratio of the first access volume of the target URL during the first time period to the average access volume; When the ratio is greater than a first ratio threshold or the ratio is less than a second ratio threshold, determining that there is an abnormal access volume of the target URL during the first time period, where the first ratio threshold is a number greater than 1 and the second ratio threshold is a number greater than 0 and less than 1.

4. The method according to claim 3, characterized in that The method further includes: When the ratio is greater than or equal to the second ratio threshold and less than or equal to the first ratio threshold, determining that the access volume of the target URL is normal during the first time period.

5. The method according to claim 3, characterized in that, The determining whether there is an abnormal access volume of the target URL during the first time period according to the average access volume and the first access volume of the target URL during the first time period includes: Determining a target access volume interval where the first access volume of the target URL during the first time period is located from multiple preset access volume intervals; Obtaining an abnormal judgment rule corresponding to the target access volume interval; Determining whether there is an abnormal access volume of the target URL during the first time period according to the abnormal judgment rule, the average access volume, and the first access volume of the target URL during the first time period.

6. The method according to claim 5, wherein The abnormal judgment rule includes: a third ratio threshold, the third ratio threshold is a number greater than 1, and the determining whether there is an abnormal access volume of the target URL during the first time period according to the abnormal judgment rule, the average access volume, and the first access volume of the target URL during the first time period includes: Determining the ratio of the first access volume of the target URL during the first time period to the average access volume; When the ratio is greater than the third ratio threshold, determining that there is an abnormal access volume of the target URL during the first time period.

7. The method according to claim 6, wherein Determining whether there is an abnormal access volume of the target URL in the first time period according to the abnormal judgment rule, the average access volume, and the first access volume of the target URL in the first time period further includes: When the ratio is less than or equal to the third ratio threshold, it is determined that the access volume of the target URL in the first time period is normal.

8. The method according to claim 6 or 7, characterized in that, The abnormal judgment rule further includes: a first difference threshold. When the ratio is greater than the third ratio threshold, determining that there is an abnormal access volume of the target URL in the first time period includes: When the ratio is greater than the third ratio threshold and the difference between the first access volume of the target URL in the first time period and the average access volume is greater than the first difference threshold, it is determined that there is an abnormal access volume of the target URL in the first time period.

9. The method according to claim 5, wherein The abnormal judgment rule includes: a fourth ratio threshold, where the fourth ratio threshold is a number greater than 0 and less than 1. Determining whether there is an abnormal access volume of the target URL in the first time period according to the abnormal judgment rule, the average access volume, and the first access volume of the target URL in the first time period includes: Determining the ratio of the first access volume of the target URL in the first time period to the average access volume; When the ratio is less than the fourth ratio threshold, it is determined that there is an abnormal access volume of the target URL in the first time period.

10. The method according to claim 9, characterized in that, Determining whether there is an abnormal access volume of the target URL in the first time period according to the abnormal judgment rule, the average access volume, and the first access volume of the target URL in the first time period further includes: When the ratio is greater than or equal to the fourth ratio threshold, it is determined that the access volume of the target URL in the first time period is normal.

11. The method according to claim 9 or 10, characterized in that, The abnormal judgment rule further includes: a second difference threshold. When the ratio is less than the fourth ratio threshold, determining that there is an abnormal access volume of the target URL in the first time period includes: When the ratio is less than the fourth ratio threshold and the difference between the average access volume and the first access volume of the target URL in the first time period is greater than the second difference threshold, it is determined that there is an abnormal access volume of the target URL in the first time period.

12. An abnormal access volume detection device, characterized in that, The device includes: A first determination module, configured to determine the first access volume of the resource locator URL of each page in the application software in the first time period; An acquisition module, configured to acquire the second access volume of the target URL in the second time period when the first access volume of the target URL in the first time period is greater than the access volume threshold of the target URL among multiple URLs, where the second time period is a time period before the first time period; A second determination module, configured to determine the average access volume according to the duration of the second time period and the second access volume. A third determination module, configured to determine whether there is an abnormal traffic volume of the target URL in the first time period according to the average traffic volume and the first traffic volume of the target URL in the first time period.

13. An electronic device, characterized in that, Comprising: A memory, a processor, and a computer program stored on the memory and executable on the processor, wherein when the processor executes the computer program, the method according to any one of claims 1-11 is implemented.

14. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, the method according to any one of claims 1-11 is implemented.

15. A computer program product, characterized in that, Including a computer program, which when executed by a processor implements the method according to any one of claims 1-11.

Images