Page view anomaly detection method and device, electronic equipment and storage medium

Abstract

The invention provides a page view anomaly detection method and device, electronic equipment and a storage medium, and the method comprises the steps: determining a first page view of a resource locator URL of each page in application software in a first time period of a specified date and a second page view of a second time period of the specified date, and in the determined plurality of URLs, determining the page view of each page in the application software; under the condition that the second access amount of the target in the second time period is the same as the first access amount in the first time period, acquiring N continuous third time periods before the first time period instead of directly determining that the access amount is abnormal at the end moment of the second time period, and according to the third visitor volume and the independent visitor number of the target URL in each third time period, continuously determining whether the visitor volume of the target URL is abnormal at the end moment of the second time period. Therefore, the accuracy of page view anomaly detection is improved.

Description

Technical Field

[0001] This application relates to the field of computer technologies, and in particular, to a method, apparatus, electronic device, and storage medium for detecting abnormal access volumes. Background Art

[0002] During the operation of application software, to ensure the healthy and stable operation of the application software, it is usually necessary to determine whether there is an abnormal access volume to the Uniform Resource Locator (URL) of each page in the application software, and in the case of an abnormal access volume, output a warning message so that the corresponding personnel can perform subsequent processing based on the warning message to ensure the healthy and stable operation of the application software.

[0003] The abnormal detection methods in the related art are usually as follows: when it is determined that there is an access volume for a corresponding URL in a first time period, obtain the access volume in a second time period that is after the first time period and immediately adjacent to the first time period. In the case that the access volume in the second time period is zero, directly determine that an abnormal access volume has occurred at the end moment of the first time period for the corresponding URL. However, for some URLs with relatively low access volumes, it often happens that the access volume is zero. Using the access volume abnormal detection method in the related art to detect abnormal access volumes is not accurate enough, and the situation of false alarms is relatively frequent. Summary of the Invention

[0004] This application provides a method, apparatus, electronic device, and storage medium for detecting abnormal access volumes.

[0005] In one aspect of the embodiments of this application, a method for detecting abnormal access volumes is provided. The method includes: determining a first access volume in a first time period and a second access volume in a second time period of the Uniform Resource Locator (URL) of each page in the application software on a specified date, where the start moment of the second time period is the same as that of the first time period, and the duration of the first time period is greater than the duration of the second time period; in the case that the second access volume of a target URL in the second time period is the same as the first access volume in the first time period among multiple URLs, obtain N consecutive third time periods before the first time period, where the duration of the third time period is the same as that of the second time period, and N is an integer greater than 1; determine whether an abnormal access volume has occurred at the end moment of the second time period for the target URL according to the third access volume and the number of independent visitors of the target URL in each of the third time periods.

[0006] The access volume anomaly detection method according to an embodiment of the present application determines the first access volume in the first time period and the second access volume in the second time period of the resource locator URL of each page in the application software on a specified date. When it is determined that among multiple URLs, the second access volume of a target URL in the second time period is the same as the first access volume in the first time period, it does not directly determine that there is an access volume anomaly at the end time of the second time period. Instead, it obtains N consecutive third time periods before the first time period, and based on the third access volume and the number of unique visitors of the target URL in each third time period, it further determines whether there is an access volume anomaly at the end time of the second time period of the target URL. Thus, by combining the third access volume and the number of unique visitors of the target URL in each third time period before the first time period, it determines whether there is an access volume anomaly at the end time of the second time period of the target URL, improving the accuracy of access volume anomaly detection.

[0007] Another embodiment of the present application provides an access volume anomaly detection device, which includes: a first determination module, configured to determine the first access volume in the first time period and the second access volume in the second time period of the resource locator URL of each page in the application software on a specified date, where the start time of the second time period is the same as that of the first time period, and the duration of the first time period is greater than the duration of the second time period; an acquisition module, configured to, when the second access volume of a target URL in the second time period is the same as the first access volume in the first time period among multiple URLs, obtain N consecutive third time periods before the first time period, where the duration of the third time period is the same as that of the second time period, and N is an integer greater than 1; a second determination module, configured to determine whether there is an access volume anomaly at the end time of the second time period of the target URL according to the third access volume and the number of unique visitors of the target URL in each third time period.

[0008] The access volume anomaly detection device according to an embodiment of the present application determines the first access volume in the first time period and the second access volume in the second time period of the resource locator URL of each page in the application software on a specified date. When it is determined that among multiple URLs, the second access volume of a target URL in the second time period is the same as the first access volume in the first time period, it does not directly determine that there is an access volume anomaly at the end time of the second time period. Instead, it obtains N consecutive third time periods before the first time period, and based on the third access volume and the number of unique visitors of the target URL in each third time period, it further determines whether there is an access volume anomaly at the end time of the second time period of the target URL. Thus, by combining the third access volume and the number of unique visitors of the target URL in each third time period before the first time period, it determines whether there is an access volume anomaly at the end time of the second time period of the target URL, improving the accuracy of access volume anomaly detection.

[0009] In another embodiment of the present application, an electronic device is provided, including: a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the computer program, the method for detecting abnormal access volume according to the embodiments of the present application is implemented.

[0010] In another embodiment of the present application, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the method for detecting abnormal access volume disclosed in the embodiments of the present application is implemented.

[0011] In another embodiment of the present application, a computer program product is provided. When the instructions in the computer program product are executed by a processor, the method for detecting abnormal access volume in the embodiments of the present application is implemented.

[0012] Other effects of the above optional methods will be described in combination with specific embodiments below. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] The drawings are used to better understand the solution and do not limit the present application. Among them:

[0014] Figure 1 is a schematic flowchart of a method for detecting abnormal access volume according to an embodiment of the present application.

[0015] Figure 2 is a schematic flowchart of a method for detecting abnormal access volume according to another embodiment of the present application.

[0016] Figure 3 is a schematic flowchart of a method for detecting abnormal access volume according to another embodiment of the present application.

[0017] Figure 4 is a schematic flowchart of a method for detecting abnormal access volume according to another embodiment of the present application.

[0018] Figure 5 is a schematic structural diagram of a device for detecting abnormal access volume according to an embodiment of the present application.

[0019] Figure 6 is a block diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0020] Embodiments of the present invention will be described in detail below. Examples of the embodiments are shown in the drawings, where the same or similar reference numerals denote the same or similar elements or elements with the same or similar functions throughout. The embodiments described below with reference to the drawings are exemplary and are intended to explain the present application and should not be construed as limiting the present application.

[0021] The method, apparatus, electronic device, and storage medium for abnormal access volume detection according to the embodiments of the present application will be described below with reference to the accompanying drawings.

[0022] Figure 1 It is a schematic flowchart of the method for abnormal access volume detection according to an embodiment of the present application. It should be noted that the execution subject of the method for abnormal access volume detection provided in this embodiment is the abnormal access volume detection device. The abnormal access volume detection device can be implemented in software and / or hardware. In this embodiment, the abnormal access volume detection device can be an electronic device or can be configured in an electronic device so that the electronic device has the function of abnormal access volume detection.

[0023] Among them, the electronic device in this embodiment may include, but is not limited to, devices such as terminal devices and servers, and this embodiment does not specifically limit the electronic device.

[0024] As Figure 1 shown, the method for abnormal access volume detection may include:

[0025] Step 101: Determine the first access volume of the resource locator URL of each page in the application software during the first time period on the specified date and the second access volume during the second time period, where the start time of the second time period is the same as that of the first time period, and the duration of the first time period is greater than the duration of the second time period.

[0026] Among them, the application software refers to software that provides specific functions, services, or operations for users. For example, the application software may include desktop clients, mobile applications, Web applications, websites, and other software specifically designed to complete specific tasks.

[0027] Among them, the above-mentioned specified date can be a date specified according to actual needs. For example, the above-mentioned specified date can be the date of today or the date of a certain day in the past. This embodiment does not specifically limit this.

[0028] Among them, the first time period is a time period set according to actual needs, and the duration of the first time period can be the first preset duration. For example, the first preset duration can be 5 minutes, 11 minutes, or 12 minutes, etc. This embodiment does not specifically limit this.

[0029] Among them, the second time period is a time period set according to actual needs, and the duration of the second time period can be the second preset duration. For example, the second preset duration can be 1 minute, 2 minutes, etc. This embodiment does not specifically limit this.

[0030] Among them, it can be understood that the duration of the second time period is less than the duration of the first time period. For example, the duration of the second time period can be 1 minute.

[0031] It should be noted that in this embodiment, the time difference between the first time period and the second time period is greater than or equal to the target time length.

[0032] The time difference between the first time period and the second time period is obtained by subtracting the length of the second time period from the length of the first time period.

[0033] The target time length is set according to actual requirements, and the target time length can be 10 minutes.

[0034] For example, if the target time length is 10 minutes, the length of the first time period can be 11 minutes, and the length of the second time period can be 1 minute. Correspondingly, the time difference between the first time period and the second time period is 10 minutes. At this time, it can be determined that the time difference between the first time period and the second time period is equal to the target time length.

[0035] In some embodiments, a possible implementation manner for determining the first access volume of the resource locator URLs of each page in the application software in the first time period and the second access volume in the second time period on a specified date is as follows: according to the URL access log of the application software, determine the first URL access log of the application software in the first time period and the second URL access log in the second time period on the specified date; according to the first URL access log, determine the first access volume of the URLs of each page in the application software in the first time period; according to the second URL access log, determine the second access volume of the URLs of each page in the application software in the second time period.

[0036] Step 102, when the second access volume of the target URL in the second time period is the same as the first access volume in the first time period among multiple URLs, obtain N consecutive third time periods before the first time period, where the third time period and the second time period have the same length, and N is an integer greater than 1.

[0037] In this embodiment, for each URL, if the second access volume of the URL in the second time period is the same as the first access volume in the first time period, then determine that the URL is the target URL.

[0038] It can be understood that if the second access volume of a URL in the second time period is equal to the first access volume in the first time period, it means that the URL has access volume in the first part of the first time period and has no access volume in the second part of the first time period.

[0039] In some embodiments, the last time period among the above N consecutive third time periods can be continuous with the first time period, that is, the end time of the last time period among the N consecutive third time periods is the start time of the first time period.

[0040] The above N is set according to actual needs. For example, N can be 5, or 6, etc. This embodiment does not specifically limit this.

[0041] Step 103: Determine whether the target URL has abnormal traffic at the end of the second time period according to the third traffic and the number of unique visitors of the target URL in each third time period.

[0042] In some embodiments, for each third time period, the third URL access log of the target application in the third time period can be determined from the URL access log of the target application, and the third visits and number of independent visitors of the target URL in the third time period can be determined based on the third access log.

[0043] In some embodiments, based on the third visits and the number of independent visitors of the target URL in each third time period, a possible implementation method for determining whether the target URL has abnormal visits at the end of the second time period may be: from multiple third time periods, a target time period in which the third visits are greater than zero and the number of independent visitors is greater than zero can be determined. When the number of target time periods is determined to be greater than or equal to a preset number threshold, it can be determined that the target URL has abnormal visits at the end of the second time period, that is, it can be determined that the URL has abnormal visits with zero visits at the end of the second time period.

[0044] In this embodiment, if the number of target time periods is less than the preset number threshold, it means that the target URL is a URL with relatively small visits. Since URLs with relatively small visits often have zero visits, it can be determined that the target URL has no abnormal visits at the end of the second time period, that is, it can be determined that the target URL has normal visits at the end of the second time period.

[0045] The preset quantity threshold is a quantity preset according to actual needs.

[0046] In some other embodiments, another possible implementation for determining whether there is an abnormal traffic volume at the end of the second time period for the target URL based on the third traffic volume and the number of unique visitors of the target URL in each third time period is as follows: The average traffic volume of N consecutive third time periods can be determined according to the third traffic volume of the target URL in each third time period and the total duration of N consecutive third time periods, and the average number of unique visitors of N consecutive third time periods can be determined according to the number of unique visitors of the target URL in each third time period and the total duration of N consecutive third time periods. Then, the average traffic volume is compared with the traffic volume threshold, and the average number of unique visitors is compared with the number of unique visitors threshold to obtain a comparison result. Based on the comparison result, it is determined whether there is an abnormal traffic volume at the end of the second time period for the target URL.

[0047] In some embodiments, in the case where the comparison result indicates that the average traffic volume is greater than or equal to the traffic volume threshold and the average number of unique visitors is greater than or equal to the number of unique visitors threshold, it is determined that there is an abnormal traffic volume at the end of the second time period for the target URL.

[0048] In some other embodiments, in the case where the comparison result indicates that the average traffic volume is less than the traffic volume threshold and / or the average number of unique visitors is less than the number of unique visitors threshold, it is determined that the traffic volume of the target URL is normal at the end of the second time period.

[0049] The traffic volume abnormal detection method according to the embodiments of the present application determines the first traffic volume of the resource locator URL (URL) of each page in the application software in the first time period of the specified date and the second traffic volume in the second time period. When it is determined that among multiple URLs, the second traffic volume of the target in the second time period is the same as the first traffic volume in the first time period, it does not directly determine that there is an abnormal traffic volume at the end of the second time period. Instead, N consecutive third time periods before the first time period are obtained, and based on the third traffic volume and the number of unique visitors of the target URL in each third time period, it is further determined whether there is an abnormal traffic volume at the end of the second time period for the target URL. Thus, by combining the third traffic volume and the number of unique visitors of the target URL in each third time period before the first time period, it is determined whether there is an abnormal traffic volume at the end of the second time period for the target URL, improving the accuracy of traffic volume abnormal detection.

[0050] Based on the above embodiments, in the case where it is determined that there is an abnormal traffic volume at the end of the second time period for the target URL, an alarm prompt message can be output, where the alarm prompt message is used to indicate that there is an abnormal traffic volume for the target URL in the first time period. Thus, the corresponding personnel can perform subsequent processing according to the alarm prompt message.

[0051] Among them, the way to output the alarm prompt information can be determined according to actual needs. For example, the alarm prompt information can be output in the form of text and / or voice. This embodiment does not specifically limit the way to output the alarm prompt information.

[0052] Figure 2 FIG. is a schematic flowchart of an abnormal access volume detection method according to another embodiment of the present application. It should be noted that this embodiment is a further refinement or optimization of the foregoing embodiment.

[0053] As Figure 2 shown, the abnormal access volume detection method may include:

[0054] Step 201, determine the first access volume in the first time period and the second access volume in the second time period of the resource locator URL of each page in the application software on a specified date, where the start time of the second time period is the same as that of the first time period, and the duration of the first time period is greater than the duration of the second time period.

[0055] Step 202, among multiple URLs, when the second access volume of the target URL in the second time period is the same as the first access volume in the first time period, obtain N consecutive third time periods before the first time period, where the duration of the third time period is the same as that of the second time period, and N is an integer greater than 1.

[0056] It should be noted that for the specific implementation manners of steps 201 and 202, reference can be made to the relevant descriptions in other embodiments, which will not be elaborated here.

[0057] Step 203, determine the first average unique visitor number of N consecutive third time periods according to the number of unique visitors of the target URL in each third time period and the total duration of N consecutive third time periods.

[0058] In this embodiment, the number of unique visitors of the target URL in each third time period can be summed to obtain the total number of unique visitors, and the first average unique visitor number of N consecutive third time periods can be determined according to the total number of unique visitors and the total duration of N consecutive third time periods.

[0059] For example, the duration of the second time period is 1 minute. Correspondingly, the duration of the third time period is also 1 minute, N is 5, and correspondingly, the total duration of 5 consecutive third time periods is 5 minutes. Assuming that the total number of unique visitors of 5 consecutive third time periods is 20, correspondingly, the first average unique visitor number of these 5 consecutive third time periods is 4.

[0060] Step 204: For each third time period, when the third access volume of the target URL in the third time period is the same as the fourth access volume in the fourth time period, the third time period is taken as the target time period, where the start time of the fourth time period is the same as that of the third time period, and the duration of the fourth time period is the same as that of the first time period.

[0061] In this embodiment, through step 204, the target time period can be determined from N consecutive third time periods.

[0062] Step 205: Determine whether there is an abnormal access volume at the end time of the second time period for the target URL according to the number of target time periods and the first average number of independent visitors.

[0063] In this embodiment, after determining the target time period from N consecutive third time periods, the number of target time periods can be counted, and it can be determined whether there is an abnormal access volume at the end time of the second time period for the target URL according to the number of target time periods and the first average number of independent visitors.

[0064] In this embodiment, in order to accurately determine whether there is an abnormal access volume at the end time of the second time period for the target URL, correspondingly, a possible implementation manner of the above step 205 is: compare the number of target time periods with a number threshold, and compare the first average number of independent visitors with a first visitor threshold to obtain a comparison result, and determine whether there is an abnormal access volume at the end time of the second time period for the target URL according to the comparison result.

[0065] In some embodiments, when the comparison result indicates that the number of target time periods is greater than or equal to the number threshold, and the first average number of independent visitors is greater than or equal to the first visitor number threshold, it is determined that there is an abnormal access volume at the end time of the second time period for the target URL.

[0066] It should be noted that the number threshold and the first visitor number threshold are preset according to actual needs, and the values of the number threshold and the first visitor number threshold are limited in this embodiment.

[0067] In other embodiments, when the comparison result indicates that the number of target time periods is less than the number threshold, and / or the first average number of independent visitors is less than the first visitor number threshold, it is determined that the access volume at the end time of the second time period for the target URL is normal.

[0068] For example, the quantity threshold can be 3, and the first visitor number threshold can be 2. Correspondingly, the quantity in the target time period can be compared with 3, and the first average unique visitor number can be compared with 2 to obtain a comparison result. If the comparison result indicates that the quantity in the target time period is greater than or equal to 3, and the first average unique visitor number is greater than or equal to 2, it is determined that there is an abnormal traffic volume at the end moment of the second time period for the target URL. Additionally, if the comparison result indicates that the quantity in the target time period is less than 3, and / or the first average unique visitor number is less than 2, it is determined that the traffic volume of the target URL is normal at the end moment of the second time period.

[0069] It should be noted that when the quantity in the target time period is greater than or equal to the quantity threshold, and the first average unique visitor number is greater than or equal to the first visitor number threshold, it indicates that the target URL itself is a URL with relatively low traffic. It is relatively normal for the traffic volume of the target URL to be zero after the end moment of the second time period. At this time, it can be determined that there is no abnormal traffic volume at the end moment of the second time period for the target URL.

[0070] The traffic volume anomaly detection method provided by the embodiments of the present application determines the first traffic volume in the first time period and the second traffic volume in the second time period of the resource locator URL of each page in the application software. Among multiple URLs, when the second traffic volume of the target URL in the second time period is the same as the first traffic volume in the first time period, N consecutive third time periods before the first time period are obtained, and the first average unique visitor number of the N consecutive third time periods is determined according to the unique visitor numbers of the target URL in each of the third time periods and the total duration of the N consecutive third time periods. And according to the third traffic volume of the target URL in each of the third time periods, the target time periods with a third traffic volume greater than zero are determined from the N consecutive third time periods, and whether there is an abnormal traffic volume at the end moment of the second time period for the target URL is determined according to the quantity of the target time periods and the first average unique visitor number. Thereby, the accuracy of traffic volume anomaly detection is further improved, and the occurrence of false alarms of abnormal traffic volume can be reduced.

[0071] Figure 3 It is a flowchart of the traffic volume anomaly detection method according to another embodiment of the present application. It should be noted that this embodiment is a further refinement or optimization of the foregoing embodiment.

[0072] As Figure 3 shown, the traffic volume anomaly detection method may include:

[0073] Step 301: Determine the first access volume of the resource locator URLs of each page in the application software during the first time period on a specified date and the second access volume during the second time period, where the start time of the second time period is the same as that of the first time period, and the duration of the first time period is greater than that of the second time period.

[0074] Step 302: Among multiple URLs, when the second access volume of the target URL during the second time period is the same as the first access volume during the first time period, obtain N consecutive third time periods before the first time period, where the duration of the third time period is the same as that of the second time period, and N is an integer greater than 1.

[0075] Step 303: Determine the first average number of unique visitors for the N consecutive third time periods based on the number of unique visitors of the target URL in each third time period and the total duration of the N consecutive third time periods.

[0076] Step 304: For each third time period, when the third access volume of the target URL during the third time period is the same as the fourth access volume during the fourth time period, use the third time period as the target time period, where the start time of the fourth time period is the same as that of the third time period, and the duration of the fourth time period is the same as that of the first time period.

[0077] It should be noted that for the specific implementation methods of Steps 301 to 304, reference can be made to the relevant descriptions in other embodiments, which will not be elaborated here.

[0078] Step 305: When the number of target time periods is greater than or equal to the number threshold and the first average number of unique visitors is greater than or equal to the first number threshold of visitors, select M consecutive time periods from the N consecutive third time periods as M consecutive fifth time periods, where the last time period among the M consecutive fifth time periods is consecutive with the second time period, and M is an integer greater than 1 and less than or equal to N.

[0079] Here, N and M are set according to actual needs. For example, N can be 5 and M can be 4. Correspondingly, 4 consecutive time periods can be selected from 5 consecutive third time periods and the selected time periods are called the fifth time periods, thus obtaining 4 consecutive fifth time periods.

[0080] It should be noted that the fact that the last time period among the M consecutive fifth time periods is consecutive with the second time period indicates that the last time period among the N consecutive third time periods is consecutive with the second time period.

[0081] Step 306: Obtain K consecutive sixth time periods after the second time period, where the duration of the sixth time period is the same as that of the second time period, and K is an integer greater than 1.

[0082] Among them, K is preset according to actual requirements. For example, K can be 5, 4, or 6, etc. This embodiment does not specifically limit the value of K.

[0083] In this embodiment, the first time period among the K consecutive sixth time periods can be consecutive with the second time period.

[0084] Step 307: Determine that there is an abnormal traffic volume at the end moment of the second time period for the target URL based on the second average unique visitor numbers of the second time period, the fifth time period, and the sixth time period respectively within H days before the specified date, where H is an integer greater than 1.

[0085] Among them, H is preset according to actual requirements. For example, H can be 7 days, 30 days, 120 days, 365 days, etc. This embodiment does not specifically limit the value of H.

[0086] In this embodiment, the unique visitor numbers of the target URL in the second time period each day within H days before the specified date can be determined, and based on the unique visitor numbers, the second average unique visitor number of the target URL in the second time period within N days can be obtained.

[0087] In this embodiment, for each fifth time period, the unique visitor numbers of the target URL in the fifth time period each day within H days before the specified date can be determined, and based on the unique visitor numbers, the second average unique visitor number of the target URL in the fifth time period within N days can be obtained.

[0088] In this embodiment, for each sixth time period, the unique visitor numbers of the target URL in the sixth time period each day within H days before the specified date can be determined, and based on the unique visitor numbers, the second average unique visitor number of the target URL in the sixth time period within N days can be obtained.

[0089] For example, M is 4 and K is 5, that is, there are 4 fifth time periods, and there are 5 sixth time periods. The second average unique visitor numbers of the second time period, the fifth time period, and the sixth time period respectively within H days before the specified date for the target URL can be determined. At this time, the second average unique visitor number is 10, and correspondingly, the smallest average unique visitor number can be determined from these 10 second average unique visitor numbers.

[0090] In some embodiments, in order to accurately determine that there is an abnormal traffic volume at the end time of the second time period for the target URL, correspondingly, a possible implementation manner of the above step 307 is: according to the second average unique visitor numbers of the second time period, the fifth time period, and the sixth time period within H days before the specified date for the target URL, determine the minimum average unique visitor number; in the case where the minimum average unique visitor number is greater than or equal to the second visitor number threshold, determine that there is an abnormal traffic volume at the end time of the second time period for the target URL.

[0091] In other embodiments, in the case where it is determined that the minimum average unique visitor number is less than the second visitor number threshold, determine that the traffic volume of the target URL is normal at the end time of the second time period. That is, in the case where the number of target time periods is greater than or equal to the number threshold, and the first average unique visitor number is greater than or equal to the first visitor number threshold, and the minimum average unique visitor number is less than the second visitor number threshold, determine that the traffic volume of the target URL is normal at the end time of the second time period. Thus, it is accurately determined whether there is an abnormal traffic volume at the end time of the second time period for the target URL, improving the accuracy of detecting abnormal traffic volume and helping to reduce the number of false alarms.

[0092] To clearly understand the present application, the method of this embodiment will be described exemplarily below in combination with Figure 4 FIG. is a schematic flowchart of a method for detecting abnormal traffic volume according to another embodiment of the present application. It should be noted that in this embodiment, an application software is taken as the target website, N is 5, M is 4, K is 5, and H is 7 as examples for exemplary description.

[0093] Figure 4 As shown in

[0094] As Figure 4 shown, the method may include:

[0095] Step 401, obtain the URL access log of the target website.

[0096] Wherein, the target website in this embodiment may be any website, and this embodiment does not make a specific limitation on the target website.

[0097] Step 402, preprocess the URL access log.

[0098] In some embodiments, the preprocessing may include data cleaning and formatting, etc. For example, invalid URLs may be removed, and parameters irrelevant to determining the traffic volume may be filtered out. Thus, the noise data in the URL access log is deleted, which helps to improve the accuracy of the traffic volume of each determined URL, and then improves the accuracy and reliability of subsequent abnormal traffic volume detection.

[0099] Step 403: Starting from the start time of the specified date in the processed URL log, use a first time window with a first preset duration, and gradually slide backward on the preprocessed URL access log at a preset step. For the i-th backward slide, regard the current URL access log within the first time window as the URL access log of the target website during the first time period on the specified date.

[0100] Wherein, i is an integer greater than or equal to 0.

[0101] Wherein, the preset step is set according to actual requirements. For example, the preset step can be 1 minute.

[0102] Wherein, the first preset duration is a duration set according to actual requirements. For example, the first preset duration can be 11 minutes.

[0103] It can be understood that in this embodiment, the durations of the first time period and the first time window are the same.

[0104] Step 404: Determine the first access volume of the URLs of each web page in the target website during the first time period according to the URL access log of the target website during the first time period.

[0105] Step 405: Starting from the start time of the specified date in the processed URL log, use a second time window with a second preset duration, and gradually slide backward on the preprocessed URL access log at a preset step. For the i-th backward slide, regard the current URL access log within the second time window as the URL access log of the target website during the second time period on the specified date.

[0106] It should be noted that the second preset duration is a duration preset according to actual requirements. For example, the second preset duration can be 1 minute.

[0107] It can be understood that the durations of the second time window and the second time period are the same.

[0108] It can be understood that for the i-th backward slide, since the steps used when the first time window and the second time window slide backward are the same, the start times corresponding to the first time window and the second time window on the processed URL log for the i-th backward slide are the same. That is to say, the start times corresponding to the first time period and the second time period in this embodiment are the same.

[0109] Step 406: Determine the second access volume of the URLs of each web page in the target website during the second time period according to the URL access log of the target website during the second time period.

[0110] Step 407: For each URL, if the first access volume of the URL in the first time period is the same as the second access volume in the second time period, then use this URL as the target URL, and generate the processing result corresponding to the target URL in the second time period when sliding backward for the i-th time, where the processing result is used to indicate whether the access volume of the target URL in the second time period is equal to that in the first time period when sliding backward for the i-th time.

[0111] It can be understood that if the first access volume of the URL in the first time period is the same as the second access volume in the second time period, a processing result can be generated to indicate that the access volume of the target URL in the second time period is equal to that in the first time period.

[0112] If the first access volume of the URL in the first time period is different from the second access volume in the second time period, a processing result can be generated to indicate that the access volume of the target URL in the second time period is not equal to that in the first time period.

[0113] Step 408: Obtain 5 consecutive third time periods before the first time period, where the duration of the third time period is the same as that of the second time period.

[0114] Among them, the last of the 5 consecutive third time periods is consecutive with the second time period.

[0115] For example, if the duration of the second time period is 1 minute, 5 consecutive third time periods with a duration of 1 minute before the first time period can be obtained.

[0116] Step 409: Obtain the processing results corresponding to the target URL in each third time period.

[0117] It can be understood that the process of obtaining the processing result corresponding to the target URL in the third time period is similar to the process of obtaining the processing result corresponding to the target URL in the second time period, which will not be elaborated here.

[0118] The processing result is used to indicate whether the access volume of the target URL in the corresponding third time period is equal to the access volume in the corresponding fourth time period.

[0119] Among them, the start time of the third time period is the same as that of its corresponding fourth time period, and the duration of the fourth time period is the same as that of the first time period.

[0120] Step 410: From the 5 consecutive third time periods, determine the target time period of the processing result used to indicate that the access volume of the corresponding third time period is equal to the access volume of the corresponding fourth time period.

[0121] Step 411: Determine the first average number of unique visitors in five consecutive third time periods based on the number of unique visitors of the target URL in each third time period and the total duration of five consecutive third time periods.

[0122] Step 412: When the number of target time periods is greater than or equal to the quantity threshold and the first average number of unique visitors is greater than or equal to the first number-of-visitors threshold, select four consecutive time periods from the five consecutive third time periods as four consecutive fifth time periods.

[0123] It should be noted that the last time period among the four consecutive fifth time periods is consecutive with the second time period.

[0124] It should be noted that when the number of target time periods is less than the quantity threshold and / or the first average number of unique visitors is less than the first number-of-visitors threshold, it is determined that the traffic volume of the target URL is normal at the end moment of the second time period.

[0125] For example, when the quantity threshold is 3 and the first number-of-visitors threshold is 2, if the number of target time periods is less than 3 and / or the first average number of unique visitors is less than 2, it is determined that the traffic volume of the target URL is normal at the end moment of the second time period. If the number of target time periods is greater than or equal to 3 and the first average number of unique visitors is greater than or equal to 2, then proceed to step 413.

[0126] Step 413: Obtain five consecutive sixth time periods after the second time period.

[0127] It should be noted that the first time period among the five consecutive sixth time periods is consecutive with the second time period, and the duration of the sixth time period is the same as that of the second time period, that is, the duration of the sixth time period is equal to that of the second time period.

[0128] Step 414: Determine the minimum average number of unique visitors based on the second average number of unique visitors of the target URL in the second time period, the fifth time period, and the sixth time period respectively within 7 days before the specified date.

[0129] In this embodiment, the second average number of unique visitors of the target URL in the second time period, the fifth time period, and the sixth time period respectively within 7 days before the specified date can be determined through the URL access log.

[0130] Step 415: When it is determined that the minimum average number of unique visitors is greater than or equal to the second number-of-visitors threshold, it is determined that there is an abnormal traffic volume of the target URL at the end moment of the second time period.

[0131] Among them, the second visitor number threshold is preset according to actual requirements. For example, the second visitor number threshold can be 2.

[0132] It should be noted that when the number of target time periods is greater than or equal to the number threshold, and the first average unique visitor number is greater than or equal to the first visitor number threshold, and it is determined that the minimum average unique visitor number is less than the second visitor number threshold, it indicates that the target URL has a relatively small traffic volume and often has a traffic volume of zero. Therefore, the traffic volume of the target URL is normal at the end moment of the second time period.

[0133] In summary, it can be seen that in the case where it is determined that the traffic volume of the corresponding URL in the second time period in the first time period is the same as the traffic volume in the first time period, it is not directly determined that there is an abnormal traffic volume at the end moment of the second time period for the corresponding URL. Instead, it combines the traffic volume, unique visitor numbers in N consecutive third time periods before the first time period for the corresponding URL, and the unique visitor numbers in the sixth time period after the second time period, and continues to judge whether there is an abnormal traffic volume at the end moment of the second time period for the URL, thereby improving the accuracy of detecting abnormal traffic volume and reducing the occurrence of false alarms caused by abnormal traffic volume.

[0134] Corresponding to the abnormal traffic volume detection methods provided in the above several embodiments, an embodiment of the present application also provides an abnormal traffic volume detection device. Since the abnormal traffic volume detection device provided in the embodiment of the present application corresponds to the abnormal traffic volume detection methods provided in the above several embodiments, the implementation manners of the abnormal traffic volume detection method are also applicable to the abnormal traffic volume detection device provided in this embodiment and will not be described in detail in this embodiment.

[0135] Figure 5 It is a schematic structural diagram of an abnormal traffic volume detection device according to an embodiment of the present application. Among them, it should be noted that the abnormal traffic volume detection device can be implemented in a software and / or hardware manner. In this embodiment, the abnormal traffic volume detection device can be an electronic device or can be configured in an electronic device. Among them, the electronic device in this embodiment can include, but is not limited to, devices such as terminal devices and servers, and this embodiment does not make specific limitations on the electronic device.

[0136] As Figure 5 shown, the abnormal traffic volume detection device 500 includes:

[0137] The first determination module 501 is configured to determine the first access volume of the resource locator URLs of each page in the application software in the first time period and the second access volume in the second time period on a specified date, where the start time of the second time period is the same as that of the first time period, and the duration of the first time period is greater than the duration of the second time period.

[0138] The acquisition module 502 is configured to, in a plurality of URLs, when the second access volume of the target URL in the second time period is the same as the first access volume in the first time period, acquire N consecutive third time periods before the first time period, where the duration of the third time period is the same as that of the second time period, and N is an integer greater than 1.

[0139] The second determination module 503 is configured to determine whether there is an abnormal access volume at the end time of the second time period of the target URL according to the third access volume and the number of unique visitors of the target URL in each third time period.

[0140] In an embodiment of the present application, the second determination module 503 includes:

[0141] The first determination unit is configured to determine the first average number of unique visitors of N consecutive third time periods according to the number of unique visitors of the target URL in each third time period and the total duration of N consecutive third time periods;

[0142] The second determination unit is configured to, for each third time period, when the third access volume of the target URL in the third time period is the same as the fourth access volume in the fourth time period, use the third time period as the target time period, where the start time of the fourth time period is the same as that of the third time period, and the duration of the fourth time period is the same as that of the first time period;

[0143] The third determination unit is configured to determine whether there is an abnormal access volume at the end time of the second time period of the target URL according to the number of target time periods and the first average number of unique visitors.

[0144] In an embodiment of the present application, the third determination unit is specifically configured to: when the number of target time periods is greater than or equal to the number threshold, and the first average number of unique visitors is greater than or equal to the first number-of-visitors threshold, determine that there is an abnormal access volume at the end time of the second time period of the target URL.

[0145] In an embodiment of the present application, the third determination unit is further configured to: when the number of target time periods is less than the number threshold, and / or the first average number of unique visitors is less than the first number-of-visitors threshold, determine that the access volume of the target URL at the end time of the second time period is normal.

[0146] In an embodiment of the present application, the third determination unit is specifically configured to: when the number of target time periods is greater than or equal to a number threshold, and the first average number of independent visitors is greater than or equal to a first visitor number threshold, select M consecutive time periods from N consecutive third time periods as M consecutive fifth time periods, where the last time period in the M consecutive fifth time periods is consecutive with the second time period, and M is an integer greater than 1 and less than or equal to N; obtain K consecutive sixth time periods after the second time period, where the duration of the sixth time period is the same as that of the second time period, and K is an integer greater than 1; determine that there is an abnormal access volume at the end time of the second time period for the target URL according to the second average number of independent visitors of the second time period, the fifth time period, and the sixth time period respectively within H days before the specified date for the target URL, where H is an integer greater than 1.

[0147] In an embodiment of the present application, the specific implementation manner of determining that there is an abnormal access volume at the end time of the second time period for the target URL according to the second average number of independent visitors of the second time period, the fifth time period, and the sixth time period respectively within H days before the specified date for the target URL is: determine the minimum average number of independent visitors according to the second average number of independent visitors of the second time period, the fifth time period, and the sixth time period respectively within H days before the specified date for the target URL; when the minimum average number of independent visitors is greater than or equal to a second visitor number threshold, determine that there is an abnormal access volume at the end time of the second time period for the target URL.

[0148] In an embodiment of the present application, the third determination unit is further configured to: when it is determined that the minimum average number of independent visitors is less than the second visitor number threshold, determine that the access volume at the end time of the second time period for the target URL is normal.

[0149] In an embodiment of the present application, the first determination module 501 is specifically configured to: determine the first URL access log of the application software in the first time period and the second URL access log of the application software in the second time period according to the URL access log of the application software; determine the first access volume of the URL of each page in the application software in the first time period according to the first URL access log; determine the second access volume of the URL of each page in the application software in the second time period according to the second URL access log.

[0150] The access volume anomaly detection device according to the embodiment of the present application determines the first access volume in the first time period and the second access volume in the second time period of the resource locator URL (Uniform Resource Locator) of each page in the application software on a specified date. Here, the start time of the second time period is the same as that of the first time period, and the duration of the first time period is greater than that of the second time period. When it is determined that among multiple URLs, if the second access volume of a target in the second time period is the same as the first access volume in the first time period, it does not directly determine that there is an access volume anomaly at the end time of the second time period. Instead, it obtains N consecutive third time periods before the first time period, and based on the third access volume and the number of unique visitors of the target URL in each third time period, it further determines whether there is an access volume anomaly at the end time of the second time period of the target URL. Thus, by combining the third access volume and the number of unique visitors of the target URL in each third time period before the first time period, it determines whether there is an access volume anomaly at the end time of the second time period of the target URL, improving the accuracy of access volume anomaly detection.

[0151] According to an embodiment of the present application, the present application also provides an electronic device and a readable storage medium.

[0152] Figure 6 It is a block diagram of an electronic device according to an embodiment of the present application.

[0153] As Figure 6 shown, the electronic device includes:

[0154] A memory 601, a processor 602, and computer instructions stored on the memory 601 and executable on the processor 602.

[0155] When the processor 602 executes the instructions, it implements the access volume anomaly detection method provided in the above embodiment.

[0156] Furthermore, the electronic device further includes:

[0157] A communication interface 603 for communication between the memory 601 and the processor 602.

[0158] The memory 601 is used to store computer instructions executable on the processor 602.

[0159] The memory 601 may include a high-speed RAM memory and may also include non-volatile memory, such as at least one disk memory.

[0160] The processor 602 is used to implement the access volume anomaly detection method in the above embodiment when executing the program.

[0161] If the memory 601, the processor 602, and the communication interface 603 are implemented independently, the communication interface 603, the memory 601, and the processor 602 can be interconnected via a bus and communicate with each other. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, an Extended Industry Standard Architecture (EISA) bus, or the like. The bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 6 only a thick line is used in Figure 6 , but it does not mean that there is only one bus or one type of bus.

[0162] Optionally, in a specific implementation, if the memory 601, the processor 602, and the communication interface 603 are integrated on a single chip, the memory 601, the processor 602, and the communication interface 603 can communicate with each other via an internal interface.

[0163] The processor 602 may be a Central Processing Unit (CPU), or an Application Specific Integrated Circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present application.

[0164] The present application also proposes a computer program product, which implements the access volume anomaly detection method of the embodiments of the present application when the instruction processor in the computer program product executes.

[0165] In the description of this specification, the description with reference to terms such as "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials, or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, without contradiction, those skilled in the art can combine and combine the different embodiments or examples described in this specification and the features of different embodiments or examples.

[0166] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the quantity of the technical features indicated. Thus, features defined with "first" and "second" may explicitly or implicitly include at least one such feature. In the description of the present application, the meaning of "a plurality" is at least two, such as two, three, etc., unless otherwise specifically defined.

[0167] Any process or method description represented in a flowchart or described otherwise herein may be understood to represent a module, segment, or portion of code including one or more executable instructions for implementing a customized logical function or process. The scope of the preferred embodiments of the present application includes additional implementations, where functions may be executed in a substantially simultaneous manner or in a reverse order according to the functions involved, rather than in the order shown or discussed, which should be understood by those skilled in the art to which the embodiments of the present application pertain.

[0168] The logic and / or steps represented in a flowchart or described otherwise herein, for example, may be considered a sequenced list of executable instructions for implementing a logical function and may be specifically implemented in any computer-readable medium for use by or in connection with an instruction execution system, apparatus, or device, such as a computer-based system, a system including a processor, or other systems that can fetch and execute instructions from the instruction execution system, apparatus, or device. For the purposes of this specification, a "computer-readable medium" may be any device that can contain, store, communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of the computer-readable medium include the following: an electrical connection portion having one or more wirings (electronic device), a portable computer diskette (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disc read-only memory (CDROM). Additionally, the computer-readable medium may even be paper or other suitable media on which a program can be printed, as the program can be obtained electronically, for example, by optically scanning the paper or other media, followed by editing, interpretation, or otherwise appropriate processing as necessary, and then stored in a computer memory.

[0169] It should be understood that each part of the present application can be implemented by hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, any one or a combination of the following technologies well known in the art can be used: discrete logic circuits with logic gate circuits for implementing logic functions on data signals, application specific integrated circuits with suitable combinational logic gate circuits, programmable gate arrays (PGAs), field programmable gate arrays (FPGAs), etc.

[0170] Those of ordinary skill in the art can understand that all or part of the steps carried by the method of the above embodiments can be completed by instructing relevant hardware through a program. The program can be stored in a computer-readable storage medium. When the program is executed, it includes one or a combination of the steps of the method embodiments.

[0171] In addition, in each embodiment of the present application, each functional unit can be integrated in a processing module, or each unit can exist physically alone, or two or more units can be integrated in a module. The above integrated module can be implemented in the form of hardware or in the form of a software functional module. When the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0172] The above-mentioned storage medium can be a read-only memory, a magnetic disk, an optical disk, etc. Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and should not be construed as limiting the present application. Those of ordinary skill in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of the present application.

Claims

1. A method for detecting abnormal access volume, characterized in that, The method includes: Determining the first access volume in the first time period and the second access volume in the second time period of the resource locator URL of each page in the application software on a specified date, where the start time of the second time period is the same as that of the first time period, and the duration of the first time period is greater than the duration of the second time period; Among multiple such URLs, when the second access volume of the target URL in the second time period is the same as the first access volume in the first time period, obtaining N consecutive third time periods before the first time period, where the duration of the third time period is the same as that of the second time period, and N is an integer greater than 1; Determining whether there is an abnormal access volume at the end time of the second time period of the target URL according to the third access volume and the number of unique visitors of the target URL in each of the third time periods.

2. The method according to claim 1, wherein The determining whether there is an abnormal access volume at the end time of the second time period of the target URL according to the third access volume and the number of unique visitors of the target URL in each of the third time periods includes: Determining the first average number of unique visitors of the N consecutive third time periods according to the number of unique visitors of the target URL in each of the third time periods and the total duration of the N consecutive third time periods; For each third time period, when the third access volume of the target URL in the third time period is the same as the fourth access volume in the fourth time period, taking the third time period as the target time period, where the start time of the fourth time period is the same as that of the third time period, and the duration of the fourth time period is the same as that of the first time period; Determining whether there is an abnormal access volume at the end time of the second time period of the target URL according to the number of target time periods and the first average number of unique visitors.

3. The method according to claim 2, characterized in that, The determining whether there is an abnormal access volume at the end time of the second time period of the target URL according to the number of target time periods and the first average number of unique visitors includes: When the number of target time periods is greater than or equal to the number threshold, and the first average number of unique visitors is greater than or equal to the first visitor number threshold, determining that there is an abnormal access volume at the end time of the second time period of the target URL.

4. The method according to claim 3, characterized in that The determining whether there is an abnormal access volume at the end time of the second time period of the target URL according to the number of target time periods and the first average number of unique visitors further includes: When the number of target time periods is less than the number threshold, and / or the first average number of unique visitors is less than the first visitor number threshold, determining that the access volume of the target URL at the end time of the second time period is normal.

5. The method according to claim 3, wherein When the number of target time periods is greater than or equal to the number threshold, and the first average number of unique visitors is greater than or equal to the first visitor number threshold, determining that there is an abnormal access volume at the end time of the second time period of the target URL includes: When the number of the target time periods is greater than or equal to a number threshold, and the first average number of unique visitors is greater than or equal to a first visitor number threshold, select M consecutive time periods from the N consecutive third time periods as M consecutive fifth time periods, where the last time period among the M consecutive fifth time periods is consecutive with the second time period, and M is an integer greater than 1 and less than or equal to N; Obtain K consecutive sixth time periods after the second time period, where the sixth time period has the same duration as the second time period, and K is an integer greater than 1; Based on the second average number of unique visitors of the second time period, the fifth time period, and the sixth time period respectively within H days before the specified date for the target URL, determine that there is an abnormal traffic volume at the end moment of the second time period for the target URL, where H is an integer greater than 1.

6. The method according to claim 5, characterized in that, The determining that there is an abnormal traffic volume at the end moment of the second time period for the target URL based on the second average number of unique visitors of the second time period, the fifth time period, and the sixth time period respectively within H days before the specified date for the target URL includes: Based on the second average number of unique visitors of the second time period, the fifth time period, and the sixth time period respectively within H days before the specified date for the target URL, determine the minimum average number of unique visitors; When the minimum average number of unique visitors is greater than or equal to a second visitor number threshold, determine that there is an abnormal traffic volume at the end moment of the second time period for the target URL.

7. The method according to claim 6, wherein The method further includes: When it is determined that the minimum average number of unique visitors is less than the second visitor number threshold, determine that the traffic volume of the target URL is normal at the end moment of the second time period.

8. The method according to any one of claims 1-7, characterized in that, The determining the first traffic volume of the resource locator URL of each page in the application software in the first time period and the second traffic volume in the second time period on the specified date includes: Based on the URL access log of the application software, determine the first URL access log of the application software in the first time period and the second URL access log in the second time period on the specified date; Based on the first URL access log, determine the first traffic volume of the URL of each page in the application software in the first time period; Based on the second URL access log, determine the second traffic volume of the URL of each page in the application software in the second time period.

9. An abnormal access volume detection device, characterized in that The device includes: A first determination module, configured to determine the first traffic volume of the resource locator URL of each page in the application software in the first time period and the second traffic volume in the second time period on the specified date, where the start moment of the second time period is the same as that of the first time period, and the duration of the first time period is greater than the duration of the second time period; An acquisition module, configured to, when the second access volume of a target URL in a second time period is the same as the first access volume in the first time period among a plurality of the URLs, acquire N consecutive third time periods before the first time period, where the duration of the third time period is the same as that of the second time period, and N is an integer greater than 1; A second determination module, configured to determine whether there is an abnormal access volume at the end moment of the second time period for the target URL according to the third access volume and the number of unique visitors of the target URL in each of the third time periods; 10. An electronic device, characterized in that, Comprising: A memory, a processor, and a computer program stored on the memory and executable on the processor, where the processor implements the method according to any one of claims 1-8 when executing the computer program; 11. A computer-readable storage medium having a computer program stored thereon, characterized in that, The computer program, when executed by the processor, implements the method according to any one of claims 1-8; 12. A computer program product, characterized in that, Comprising a computer program, which, when executed by the processor, implements the method according to any one of claims 1-8;

Images