Abnormality detection method and device, equipment, storage medium and program product

Abstract

The embodiment of the invention relates to an anomaly detection method and device, equipment, a storage medium and a program product. The method comprises the following steps: acquiring multiple pieces of target behavior data including target time characteristics and target position characteristics of a target user; determining a target triggering frequency corresponding to the corresponding target position feature based on the target time feature; performing digital processing on each target position feature to determine a target coding value; constructing a two-dimensional single-channel image corresponding to the target user by taking any two dimensions of a time dimension, a frequency dimension and a position dimension as two-dimensional coordinate axes based on the target coding value, the target triggering frequency and the target time feature and representing an image pixel value by the residual dimension; and performing image processing of anomaly detection on the image features of the two-dimensional single-channel image by using a preset image detection algorithm to generate an image anomaly value, and determining whether the target user has an abnormal behavior based on the image anomaly value and a preset anomaly threshold. Therefore, the accuracy and efficiency of abnormal behavior detection are improved.

Description

Technical Field

[0001] This disclosure relates to the field of information processing technology, and in particular to an anomaly detection method, apparatus, device, storage medium, and program product. Background Art

[0002] With the development of mobile devices and internet technology, many services are now conducted through online programs (such as applications, mini-programs, and web pages). However, online programs are prone to malicious users (or abusive users) who can disrupt normal program functionality. Therefore, certain methods are needed to detect and identify abusive users.

[0003] Currently, there are roughly three main methods for anomaly detection: one is based on predefined rules or behavioral patterns; another is through statistical analysis and probabilistic models; and the third is through machine learning models. However, rule-based anomaly detection methods lack flexibility and struggle to adapt to constantly changing and complex anomaly behaviors; statistical model-based methods have poor accuracy in detecting anomalies in dynamically changing and complex behaviors; and machine learning model-based methods rely on large amounts of high-quality labeled data to train the model, which is time-consuming and labor-intensive. Therefore, current anomaly detection methods cannot achieve a good balance between detection accuracy and efficiency across various business scenarios. Summary of the Invention

[0004] To address the aforementioned technical problems, this disclosure provides an anomaly detection method, apparatus, device, storage medium, and program product.

[0005] In a first aspect, embodiments of this disclosure provide an anomaly detection method, the method comprising:

[0006] Acquire multiple target behavior data corresponding to the target user; wherein, the target behavior data includes target time features and target location features; the target time features include the characteristics of the target behavior in the time dimension; the target location features include the characteristics of the trigger location of the interactive operation corresponding to the target behavior;

[0007] Based on the target time characteristics, determine the number of target triggers corresponding to the corresponding target location characteristics;

[0008] The target location features are digitally processed to determine the target encoding value of the target location features;

[0009] Based on the target encoding value, the number of target triggers and the target time features corresponding to each target behavior data, a two-dimensional single-channel image corresponding to the target user is constructed by using any two of the time dimension, the number of times dimension and the location dimension as two-dimensional coordinate axes and the remaining dimension to represent the image pixel value.

[0010] Using a preset image detection algorithm, image processing is performed on the image features extracted from the two-dimensional single-channel image to detect anomalies, generating image anomaly values. Based on the image anomaly values ​​and a preset anomaly threshold, it is determined whether the target user exhibits abnormal behavior.

[0011] In some embodiments, the step of constructing a two-dimensional single-channel image corresponding to the target user based on the target encoding value, the number of target triggers, and the target time features corresponding to each of the target behavior data, using any two dimensions of time, number of triggers, and location as two-dimensional coordinate axes, and using the remaining dimensions to represent image pixel values, includes:

[0012] Using the time dimension and the location dimension as the two-dimensional coordinate axes, and the number dimension to represent the image pixel value, the target encoding value and the target time feature corresponding to each target behavior data are mapped to pixel units, and the target trigger count corresponding to the corresponding target behavior data is mapped to the pixel value of the pixel unit to construct the two-dimensional single-channel image corresponding to the target user.

[0013] In other embodiments, the step of constructing a two-dimensional single-channel image corresponding to the target user based on the target encoding value, the number of target triggers, and the target time features corresponding to each of the target behavior data, using any two dimensions of time, number of triggers, and location as two-dimensional coordinate axes, and using the remaining dimensions to represent image pixel values, includes:

[0014] Using the time dimension and the number of times dimension as the two-dimensional coordinate axes, and the position dimension to represent the image pixel value, the target trigger count and the target time feature corresponding to the corresponding target behavior data are mapped to pixel units, and the target encoding value corresponding to the corresponding target behavior data is mapped to the pixel value of the pixel unit to construct the two-dimensional single-channel image corresponding to the target user.

[0015] In some other embodiments, the step of constructing a two-dimensional single-channel image corresponding to the target user based on the target encoding value, the number of target triggers, and the target time features corresponding to each of the target behavior data, using any two of the time dimension, the number of triggers dimension, and the location dimension as two-dimensional coordinate axes, and using the remaining dimensions to represent image pixel values, includes:

[0016] Using the location dimension and the number of times dimension as the two-dimensional coordinate axes, and the time dimension to represent the image pixel value, the target encoding value and the number of target triggers corresponding to the corresponding target behavior data are mapped to pixel units, and the target time feature corresponding to the corresponding target behavior data is mapped to the pixel value of the pixel unit to construct the two-dimensional single-channel image corresponding to the target user.

[0017] In some embodiments, before constructing the two-dimensional single-channel image corresponding to the target user, using the time dimension and the position dimension as the two-dimensional coordinate axes, the number dimension to characterize the image pixel value, mapping the target encoding value and the target time feature corresponding to each target behavior data to a pixel unit, and mapping the target trigger count corresponding to the corresponding target behavior data to the pixel value of the pixel unit, the method further includes:

[0018] Based on the preset time granularity and / or the time range corresponding to the anomaly detection business scenario, construct the first coordinate range of the first coordinate axis corresponding to the time dimension;

[0019] Based on the preset location granularity and / or the location encoding range corresponding to the anomaly detection business scenario, a second coordinate range corresponding to the second coordinate axis of the location dimension is constructed; wherein, the first coordinate axis and the second coordinate axis are perpendicular to each other.

[0020] In some embodiments, based on the location encoding range corresponding to the anomaly detection service scenario, a second coordinate range corresponding to the second coordinate axis of the location dimension is constructed, including:

[0021] Based on the order of magnitude of the first coordinate range, the location encoding range is grouped to convert the location encoding range into a numerical range of the order of magnitude, which is then used as the second coordinate range.

[0022] In some embodiments, obtaining multiple target behavior data corresponding to a target user includes:

[0023] Obtain the raw log data corresponding to the anomaly detection business scenario, and filter the target behavior data from the raw log data based on the behavior location information where the number of behavior triggers exceeds a preset threshold; wherein, the number of behavior triggers is the total number of times the behavior location is triggered at each behavior time.

[0024] In some embodiments, the step of digitizing each of the target location features to determine the target encoding value of the target location feature includes:

[0025] Based on the target location features, the target mapping relationship is queried to determine the target encoding value of the target location features; wherein, the target mapping relationship records the one-to-one correspondence between the location features of each behavior and the encoding value of each behavior in the anomaly detection business scenario.

[0026] In some embodiments, before querying the target mapping relationship based on the target location features and determining the target encoding value of the target location features, the method further includes:

[0027] Based on the historical log data and behavior location information where the number of behavior triggers exceeds a preset threshold corresponding to the anomaly detection business scenario, each behavior location feature and the number of behavior triggers for each behavior location feature are determined. Based on the sorted behavior location features and multiple preset encoding values, the behavior encoding value corresponding to each behavior location feature is determined to construct the target mapping relationship. The sorted behavior location features are obtained by reversing the order of each behavior location feature based on the number of behavior triggers.

[0028] Alternatively, based on historical log data and behavior location information where the number of triggers exceeds a preset threshold corresponding to the anomaly detection business scenario, each behavior location feature is determined, and a target conversion algorithm is used to digitize the behavior location features to generate the behavior encoding value corresponding to the behavior location feature, so as to construct the target mapping relationship; wherein, the target conversion algorithm includes a preset hash algorithm, a preset encoding algorithm, or a machine learning model.

[0029] In some embodiments, the target behavior data includes click behavior data, the target time feature includes click time, and the target location feature includes click page path and page click area.

[0030] Secondly, embodiments of this disclosure also provide an anomaly detection device, the device comprising:

[0031] The target behavior data acquisition module is used to acquire multiple target behavior data corresponding to a target user; wherein, the target behavior data includes target time features and target location features; the target time features include the characteristics of the target behavior in the time dimension; the target location features include the characteristics of the trigger location of the interactive operation corresponding to the target behavior;

[0032] The target trigger count determination module is used to determine the target trigger count corresponding to the target location characteristics based on the target time characteristics;

[0033] The target encoding value determination module is used to perform digital processing on each of the target location features and determine the target encoding value of the target location feature;

[0034] A two-dimensional single-channel image construction module is used to construct a two-dimensional single-channel image corresponding to the target user based on the target encoding value, the number of target triggers and the target time features corresponding to each target behavior data, using any two of the time dimension, the number dimension and the position dimension as two-dimensional coordinate axes, and using the remaining dimension to represent the image pixel value.

[0035] The abnormal behavior detection module is used to perform image processing on the image features extracted from the two-dimensional single-channel image using a preset image detection algorithm, generate image anomaly values, and determine whether the target user has abnormal behavior based on the image anomaly values ​​and a preset anomaly threshold.

[0036] In some embodiments, the two-dimensional single-channel image construction module is specifically used for:

[0037] Using the time dimension and the location dimension as the two-dimensional coordinate axes, and the number dimension to represent the image pixel value, the target encoding value and the target time feature corresponding to each target behavior data are mapped to pixel units, and the target trigger count corresponding to the corresponding target behavior data is mapped to the pixel value of the pixel unit to construct the two-dimensional single-channel image corresponding to the target user.

[0038] In other embodiments, the two-dimensional single-channel image construction module is specifically used for:

[0039] Using the time dimension and the number of times dimension as the two-dimensional coordinate axes, and the position dimension to represent the image pixel value, the target trigger count and the target time feature corresponding to the corresponding target behavior data are mapped to pixel units, and the target encoding value corresponding to the corresponding target behavior data is mapped to the pixel value of the pixel unit to construct the two-dimensional single-channel image corresponding to the target user.

[0040] In some other embodiments, the two-dimensional single-channel image construction module is specifically used for:

[0041] Using the location dimension and the number of times dimension as the two-dimensional coordinate axes, and the time dimension to represent the image pixel value, the target encoding value and the number of target triggers corresponding to the corresponding target behavior data are mapped to pixel units, and the target time feature corresponding to the corresponding target behavior data is mapped to the pixel value of the pixel unit to construct the two-dimensional single-channel image corresponding to the target user.

[0042] In some embodiments, the anomaly detection device further includes a coordinate range determination module, used for:

[0043] Before constructing the two-dimensional single-channel image corresponding to the target user, using the time dimension and the position dimension as the two-dimensional coordinate axis, the number dimension to represent the image pixel value, mapping the target encoding value and the target time feature corresponding to each target behavior data to pixel units, and mapping the target trigger count corresponding to the corresponding target behavior data to the pixel value of the pixel unit, a first coordinate range corresponding to the first coordinate axis of the time dimension is constructed based on a preset time granularity and / or the time range corresponding to the anomaly detection business scenario.

[0044] Based on the preset location granularity and / or the location encoding range corresponding to the anomaly detection business scenario, a second coordinate range corresponding to the second coordinate axis of the location dimension is constructed; wherein, the first coordinate axis and the second coordinate axis are perpendicular to each other.

[0045] In some embodiments, the coordinate range determination module is specifically used for:

[0046] Based on the order of magnitude of the first coordinate range, the location encoding range is grouped to convert the location encoding range into a numerical range of the order of magnitude, which is then used as the second coordinate range.

[0047] In some embodiments, the target behavior data acquisition module is specifically used for:

[0048] Obtain the raw log data corresponding to the anomaly detection business scenario, and filter the target behavior data from the raw log data based on the behavior location information where the number of behavior triggers exceeds a preset threshold; wherein, the number of behavior triggers is the total number of times the behavior location is triggered at each behavior time.

[0049] In some embodiments, the target encoded value determination module is specifically used for:

[0050] Based on the target location features, the target mapping relationship is queried to determine the target encoding value of the target location features; wherein, the target mapping relationship records the one-to-one correspondence between the location features of each behavior and the encoding value of each behavior in the anomaly detection business scenario.

[0051] In some embodiments, the anomaly detection device further includes a target mapping relationship construction module, used for:

[0052] Before determining the target encoding value of the target location feature by querying the target mapping relationship based on the target location feature, the behavior location feature and the behavior trigger count of the behavior location feature are determined based on the historical log data corresponding to the anomaly detection business scenario and the behavior location information where the behavior trigger count exceeds a preset threshold. Then, based on the sorted behavior location features and multiple preset encoding values, the behavior encoding value corresponding to the behavior location feature is determined to construct the target mapping relationship. The sorted behavior location features are obtained by reversing the order of the behavior trigger counts.

[0053] Alternatively, before querying the target mapping relationship based on the target location features and determining the target encoding value of the target location features, based on the historical log data corresponding to the anomaly detection business scenario and the behavior location information where the number of behavior triggers exceeds a preset threshold, each behavior location feature is determined, and the behavior location features are digitized using a target conversion algorithm to generate the behavior encoding value corresponding to the behavior location feature, so as to construct the target mapping relationship; wherein, the target conversion algorithm includes a preset hash algorithm, a preset encoding algorithm, or a machine learning model.

[0054] In some embodiments, the target behavior data includes click behavior data, the target time feature includes click time, and the target location feature includes click page path and page click area.

[0055] Thirdly, embodiments of this disclosure also provide an electronic device, the electronic device comprising:

[0056] Processor and memory;

[0057] The processor executes the anomaly detection method described in any embodiment of this disclosure by calling the program or instructions stored in the memory.

[0058] Fourthly, embodiments of this disclosure also provide a computer-readable storage medium storing a program or instructions that cause a computer to execute the anomaly detection method described in any embodiment of this disclosure.

[0059] Fifthly, embodiments of this disclosure also provide a computer program product for implementing the anomaly detection method described in any embodiment of this disclosure.

[0060] The anomaly detection method, apparatus, device, storage medium, and program product provided in this disclosure can acquire multiple target behavior data corresponding to a target user; the target behavior data includes target time features and target location features; determine the target trigger count corresponding to each target location feature, and digitize each target location feature to determine the target encoding value of the target location feature; based on the target encoding value, the target trigger count, and the target time feature corresponding to each target behavior data, construct a two-dimensional single-channel image corresponding to the target user, using any two dimensions of time dimension, count dimension, and location dimension as two-dimensional coordinate axes, and using the remaining dimension to represent image pixel values; and utilize a preset image... The image detection algorithm performs anomaly detection on image features extracted from the two-dimensional single-channel image, generates image anomaly values, and determines whether the target user exhibits abnormal behavior based on the image anomaly values ​​and a preset anomaly threshold. This method efficiently and conveniently converts multiple target behavior data of the target user in an online program into a two-dimensional single-channel image according to their time, frequency, and location dimensions. Leveraging the high efficiency and accuracy of image anomaly detection, the method simultaneously improves the accuracy and efficiency of abnormal behavior detection. Furthermore, the universality of converting behavior data into two-dimensional single-channel images allows the anomaly detection method to be efficiently and flexibly adapted to various business scenarios, enhancing the universality and flexibility of anomaly detection.

[0061] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in the embodiments of this disclosure are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation entry points are provided for users to choose to authorize or refuse. Attached Figure Description

[0062] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0063] To more clearly illustrate the technical solutions in the embodiments of this disclosure or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, those skilled in the art can obtain other drawings based on these drawings without creative effort.

[0064] Figure 1 A flowchart illustrating an anomaly detection method provided in an embodiment of this disclosure;

[0065] Figure 2A schematic diagram of a two-dimensional single-channel image corresponding to the interactive behavior of a normal user in an image mode provided in an embodiment of this disclosure;

[0066] Figures 3(a) and 3(b) are Figure 2 A schematic diagram of a two-dimensional single-channel image corresponding to the abnormal user interaction behavior in the corresponding image mode;

[0067] Figures 3(c) and 3(d) are schematic diagrams of two-dimensional single-channel images corresponding to the interaction behaviors of normal users and abnormal users in another image mode provided by the embodiments of this disclosure;

[0068] Figures 3(e) and 3(f) are schematic diagrams of two-dimensional single-channel images corresponding to the interaction behaviors of normal users and abnormal users in another image mode provided by the embodiments of this disclosure;

[0069] Figure 4 A flowchart illustrating another anomaly detection method provided in this embodiment of the present disclosure;

[0070] Figure 5 This is a schematic diagram of the structure of an anomaly detection device provided in an embodiment of this disclosure;

[0071] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this disclosure. Detailed Implementation

[0072] To better understand the above-mentioned objectives, features, and advantages of this disclosure, the solutions disclosed herein will be described in further detail below. It should be noted that, unless otherwise specified, the embodiments and features described herein can be combined with each other.

[0073] Numerous specific details are set forth in the following description in order to provide a full understanding of this disclosure, but this disclosure may also be implemented in other ways different from those described herein; obviously, the embodiments in the specification are only some, and not all, of the embodiments of this disclosure.

[0074] The anomaly detection method provided in this disclosure is applicable to scenarios involving the detection of abnormal behavior in online programs (such as applications, mini-programs, or web pages). This method can be executed by an anomaly detection device, which can be implemented in software and / or hardware. This device can be integrated into electronic devices with certain data processing capabilities, such as smartphones, personal digital assistants (PDAs), tablet computers (Tablet PCs), laptops, desktop computers, or servers.

[0075] Figure 1 This is a flowchart of an anomaly detection method provided in an embodiment of this disclosure. See also... Figure 1 The anomaly detection method specifically includes:

[0076] S110. Obtain multiple target behavior data corresponding to the target user; the target behavior data includes target time features and target location features.

[0077] The target user is the user to be detected for anomalies, which can be represented by a user identifier or a device identifier. Target behavior data refers to the data related to interactive operations / behaviors (referred to as target behaviors) generated during the use of the online program in this anomaly detection process. Target time characteristics include the time dimension characteristics of the target behavior, which can be the moment the target behavior occurs, such as an absolute moment or a relative moment relative to the start time of the time range covered by this anomaly detection process. Target location characteristics include the characteristics of the triggering location of the interactive operation corresponding to the target behavior, which can be represented as the page path and specific interactive area of ​​the interactive operation.

[0078] Specifically, electronic devices can, according to anomaly detection requirements, acquire log data of a target user's use of online programs over n days (n being a positive integer greater than or equal to 1), and extract multiple target behavior data from this log data. To ensure computational efficiency and detection effectiveness, a certain amount of target behavior data can be extracted from the log data. Then, for each target behavior data, at least the target time feature and the target location feature are acquired. Both the target time feature and the target location feature are represented in the form of log data records (such as text or string format).

[0079] In some embodiments, the target behavior data includes click behavior data, the target time feature includes click time, and the target location feature includes the clicked page path and the clicked area on the page.

[0080] Specifically, in this embodiment of the disclosure, anomaly detection can be performed on click behavior. Therefore, the target behavior data can be related data of click behavior in log data (hereinafter referred to as click behavior data). Correspondingly, the target time feature is the time when the click behavior occurs, i.e., the click time. The target location feature is correspondingly implemented as the specific click location of the click behavior, which can be characterized by the click page path (such as the number of pages clicked) and the click area where the click behavior occurred in the last page (hereinafter referred to as the page click area).

[0081] In some embodiments, S110 includes: acquiring raw log data corresponding to the anomaly detection business scenario, and filtering target behavior data from the raw log data based on behavior location information where the number of behavior triggers exceeds a preset threshold.

[0082] The anomaly detection scenario defines the functions of the online program to be covered by anomaly detection. These functions correspond to the behavioral locations of multiple interactive operations / behaviors. Raw log data is the log data directly generated during the use of the online program, obtained during this anomaly detection process. Behavior location information refers to the information of behavioral locations whose trigger counts exceed a preset threshold. This information is used to filter out more important behavioral locations from among many. Here, behavioral location refers to the trigger location of the interactive operation corresponding to the interactive behavior. The preset threshold is a pre-defined critical value for the number of behavior triggers. Behavior locations at or below this threshold are considered unimportant, while those above are considered important. In other words, behavioral locations that have undergone a relatively high number of interactive operations in actual application can be monitored as key behavioral locations. The number of behavior triggers is the total number of triggers for a behavioral location at each behavior time (the time the interactive behavior occurs). It does not require distinguishing the time of the interactive behavior but rather counting the total number of triggers for the same behavioral location.

[0083] Specifically, anomaly detection scenarios may involve numerous behavioral locations, some of which are key behavioral locations that contribute significantly to business functionality and / or have a high frequency of interactions, while others are non-key behavioral locations that contribute less and / or have occasional interactions. Processing all behavioral locations for anomaly detection would, on the one hand, lead to an excessively large amount of basic data, creating a computational burden and reducing anomaly detection efficiency; on the other hand, non-key behavioral locations might interfere with anomaly detection, reducing its accuracy. Therefore, in this embodiment, after obtaining the raw log data corresponding to the anomaly detection scenario, the log data can be filtered using behavioral location information where the number of triggers exceeds a preset threshold. This allows for the selection of log data corresponding to key behavioral locations as target behavioral data for subsequent anomaly detection. This reduces the amount of data computation, further improving anomaly detection efficiency, and also reduces interference from redundant data, further improving anomaly detection accuracy.

[0084] In other embodiments, preset behavior location information can be used to filter raw log data to determine target behavior data. This preset behavior location information refers to information related to pre-defined behavior locations (hereinafter referred to as preset behavior locations). Preset behavior locations can be configured based on key / core business functions or business functions of particular interest to the business party. For example, preset behavior location information could be function call operations involved in key business functions / business functions of particular interest to the business party, interactive pages and / or interactive controls involved in key business functions / business functions of particular interest to the business party, etc. That is, key / critical behavior locations set at the business level can be monitored as key behavior locations. This allows for monitoring of business-related behavior locations, thereby enabling the detection of abnormal user behavior from a business perspective and improving the accuracy and compliance of business functions.

[0085] In some other embodiments, the raw log data can be filtered using both behavior location information where the number of triggers exceeds a preset threshold and preset behavior location information to identify target behavior data. This allows both key behavior locations defined at the business level and behavior locations where numerous interactions occur during actual application to be monitored as key behavior locations, thereby further improving the coverage and comprehensiveness of behavior anomaly detection.

[0086] S120. Based on the target time characteristics, determine the number of target triggers corresponding to the target location characteristics.

[0087] The target trigger count refers to the number of times the same interactive behavior occurs. Here, "same interactive behavior" refers to interactive behaviors with the same target location characteristics. For example, for a click behavior, "same interactive behavior" refers to click behaviors at the same click location.

[0088] Specifically, the number of times the same interactive behavior is triggered within a certain period can reflect, to some extent, whether the target user is an abnormal user. For example, the number of times a normal user performs an interactive behavior may fall within a certain range over a certain period, while the behavior time and number of triggers of an abnormal user may exceed the above time range and number range, resulting in abnormal bursts of interaction. Therefore, electronic devices can statistically analyze the target location features in the target behavior data obtained above according to their corresponding target time features to determine the number of times each target location feature appears within the behavior time corresponding to each target time feature.

[0089] S130. Digitize the features of each target location to determine the target encoding value of the target location features.

[0090] The target encoded value is the encoded value obtained by converting the target location features from log record form to numerical form, and it can be a single numerical value.

[0091] Specifically, given that various methods for anomaly detection based on behavioral data in related technologies suffer from various problems, resulting in limited efficiency and accuracy, this embodiment of the disclosure transforms the problem from anomaly detection based on interaction behavior sequences to an anomaly detection problem based on images. This allows for efficient and accurate anomaly detection by leveraging the rich processing algorithms available for images. The aforementioned interaction behavior sequence consists of multiple interaction behaviors arranged chronologically according to their occurrence time. Based on this, this embodiment of the disclosure converts the interaction behavior sequence into a two-dimensional single-channel image composed of horizontal and vertical coordinate axes. To simplify the coordinate scale of the horizontal and vertical axes, this embodiment of the disclosure converts the relevant features in the target behavior data from log record format to digital format. The target time feature can be converted from an absolute time to a relative number of minutes relative to the start time of the time range covered by this anomaly detection process. The obtained target trigger count can be retained in its digital form. Given that the target location feature consists of relatively long text or strings, this embodiment of the disclosure can digitize it to convert it into a simple numerical value, namely the target encoding value. Thus, each target behavior data can obtain the corresponding target time feature, target encoding value, and target trigger count.

[0092] In some embodiments, the digitization of target location features can be achieved by selecting a preset coded value from a plurality of pre-configured coded values ​​(hereinafter referred to as preset coded values) according to a pre-set assignment rule, and using this preset coded value as the target coded value for the target location feature. The preset coded values ​​can be values ​​within a manually set numerical range (such as integers from 0 to m); or they can be multiple values ​​pre-generated according to a certain rule (such as random number generation, linear or non-linear numerical transformation formulas, etc.). This can improve the efficiency of location feature digitization.

[0093] In other embodiments, the digitization of target location features can be achieved by pre-setting an algorithm to convert text / strings into numerical values ​​(such as a digitization algorithm based on hashing or ASCII encoding), or by pre-training a machine learning model to convert text / strings into numerical values. Then, the target location features are used as input data to the aforementioned algorithm or machine learning model, and after processing by the algorithm or model, the target encoded value is obtained. This improves the flexibility of location feature digitization.

[0094] S140. Based on the target encoding value, target trigger count, and target time characteristics corresponding to each target behavior data, construct a two-dimensional single-channel image corresponding to the target user by using any two of the time dimension, count dimension, and location dimension as two-dimensional coordinate axes and the remaining dimensions to represent the image pixel values.

[0095] A two-dimensional single-channel image is an image consisting of two dimensions (rows and columns) and containing an independent information channel, where each pixel has a pixel value. In one example, the pixel value can be a pixel value, thus making the two-dimensional single-channel image a two-dimensional grayscale image. In another example, the pixel value can be another color value. For instance, by pre-defining the mapping relationship between pixel values ​​and other color values ​​using a lookup table, pixel values ​​can be converted from pixel values ​​to other color values, thus making the two-dimensional single-channel image a two-dimensional color image.

[0096] Specifically, as described above, in this embodiment, the target user's interaction behavior sequence is converted into a two-dimensional single-channel image, which is a two-dimensional scatter plot composed of a horizontal axis and a vertical axis. To detect abnormal behaviors related to at least two of the interaction behaviors—time, number of interactions, and interaction location—this embodiment uses any two of the time, number of interactions, and location dimensions as the horizontal and vertical axes, respectively, and maps the features of the corresponding dimensions to pixel units in the two-dimensional single-channel image. Simultaneously, the remaining dimension is used as the image pixel value, and the features of the corresponding dimension are mapped to the pixel values ​​of the aforementioned pixel units. In this way, the target time features, target encoding values, and target trigger counts corresponding to each target behavior data can be used to construct a two-dimensional single-channel image corresponding to the target user.

[0097] In some embodiments, S140 includes: using time and location dimensions as two-dimensional coordinate axes, and the number of times dimension to characterize the image pixel value, mapping the target encoding value and target time feature corresponding to each target behavior data to pixel units, and mapping the target trigger count corresponding to the corresponding target behavior data to the pixel value of the pixel unit, thereby constructing a two-dimensional single-channel image corresponding to the target user.

[0098] Specifically, for anomalies with fixed time intervals or recurring interactive behaviors (such as frequent clicks on the same location) or location sequence anomalies (such as atypical paths), electronic devices can construct a two-dimensional single-channel image using the time dimension and the location dimension as the horizontal and vertical axes, respectively, and the number of triggers as the pixel value. Based on this, for each target behavior data point, the electronic device can locate the target encoding value and target time feature corresponding to that target behavior data onto the corresponding coordinate axis, determining its pixel position in the image, i.e., mapping it to a pixel unit. Then, the number of target triggers corresponding to that target behavior data is used as the pixel value of that pixel position / pixel unit. In this way, each target behavior data point can be converted into corresponding image pixels, generating a two-dimensional single-channel image corresponding to the target user's interactive behavior. Each pixel in this image represents a behavior occurring at a specific interactive location at a specific time point. The greater the number of target triggers, the larger the pixel value, and the deeper / richer the color value in the image. In this image mode, image anomaly analysis focuses more on the spatiotemporal distribution of interactive behaviors and the uniformity of pixel values ​​as behavior time and behavior location change. Subsequent anomaly detection of this two-dimensional single-channel image can identify behavioral anomalies or location sequence anomalies with periodic characteristics. This two-dimensional single-channel image can be unified across a time scale and has good interpretability.

[0099] In other embodiments, S140 includes: using time and frequency dimensions as two-dimensional coordinate axes, and position dimension to characterize image pixel values, mapping the target trigger count and target time features corresponding to the corresponding target behavior data to pixel units, and mapping the target encoding value corresponding to the corresponding target behavior data to the pixel value of the pixel unit, thereby constructing a two-dimensional single-channel image corresponding to the target user.

[0100] Specifically, for explosive clicks (such as a surge in clicks within a short period) or prolonged periods of inactivity, electronic devices can construct a two-dimensional single-channel image using the time dimension and the number of clicks as the horizontal and vertical axes of the two-dimensional image, respectively, and the position dimension as the pixel value. Based on this, for each target behavior data point, the electronic device can locate the target time feature and the number of triggers corresponding to that target behavior data onto the corresponding coordinate axes, determining its pixel position in the image, i.e., mapping it to a pixel unit. Then, the target encoding value corresponding to the target position feature in the target behavior data is used as the pixel value of that pixel position / pixel unit. If the coordinate ranges corresponding to the number of clicks and / or the time dimension have undergone numerical grouping and merging processing, the target encoding values ​​of the target behavior data falling within the range corresponding to a certain time axis scale and a certain number of click axis scale can be accumulated, or the number of these target encoding values ​​can be counted. The accumulated encoding value or the counted number is then used as the pixel value of the corresponding pixel unit. In this way, each target behavior data point can be converted into corresponding image pixels, generating a two-dimensional single-channel image corresponding to the target user's interaction behavior. Each pixel in this image represents the distribution of behavioral locations at a specific time point and the number of interactions. The larger the target encoding value, the larger the pixel value, and the deeper / richer the color value in the image. In this image mode, anomaly analysis focuses more on the distribution of pixels corresponding to behavioral locations in the image as behavior time and trigger count change, and / or on whether there are excessively large pixel values. Subsequent anomaly detection of this two-dimensional single-channel image can then identify abnormal behavior.

[0101] In some other embodiments, S140 includes: using the position dimension and the number of times dimension as two-dimensional coordinate axes, and the time dimension to represent the image pixel value, mapping the target encoding value and the number of target triggers corresponding to the corresponding target behavior data to pixel units, and mapping the target time feature corresponding to the corresponding target behavior data to the pixel value of the pixel unit, to construct a two-dimensional single-channel image corresponding to the target user.

[0102] Specifically, for abnormal hotspots (such as a sudden surge in clicks in a previously unpopular area) or anomalies in location distribution, electronic devices can use the location dimension and the frequency dimension as the horizontal and vertical axes of a two-dimensional image, respectively, and the time dimension as the pixel value, constructing a two-dimensional single-channel image. Based on this, for each target behavior data, the electronic device can locate the target encoding value and the target trigger count corresponding to the target behavior data to the corresponding coordinate axis, determining its pixel position in the image, i.e., mapping it to a pixel unit. Then, the target time feature corresponding to the target behavior data is used as the pixel value of that pixel position / pixel unit. In this way, each target behavior data can be converted into corresponding image pixels, generating a two-dimensional single-channel image corresponding to the target user's interaction behavior. Each pixel (x, y) in this image represents the target time feature of the interaction behavior occurring at the xth trigger count at behavior position y. The larger the value of the target time feature, the larger the pixel value, and the deeper / richer the color value in the image. It can be noted that, in order to fully reflect the characteristics of behavior time, the trigger count on the frequency axis here is the cumulative value of the trigger counts corresponding to the specific behavior time and the time period before it. In this image mode, image anomaly analysis focuses more on the changes in the number of pixels and / or the changes in pixel values ​​of each target temporal feature corresponding to the same behavioral location as the number of triggers change. Subsequent anomaly detection of this two-dimensional single-channel image can then be used to identify anomalous behaviors.

[0103] S150. Using a preset image detection algorithm, perform image processing to detect anomalies in the image features extracted from the two-dimensional single-channel image, generate image anomaly values, and determine whether the target user has abnormal behavior based on the image anomaly values ​​and the preset anomaly threshold.

[0104] The preset image detection algorithm is a pre-selected algorithm / model used for anomaly detection in images. Its input data is image features, and its output is image anomaly values. In one example, the preset image detection algorithm could be an unsupervised machine learning model. For instance, the preset image detection algorithm could be an autoencoder, which reconstructs a two-dimensional single-channel image and characterizes image anomalies based on the degree of difference between the reconstructed image and the two-dimensional single-channel image. Another example is a high-dimensional clustering method based on Deep Convolutional Embedded Clustering (DCEC), which roughly involves first obtaining at least one normal image cluster corresponding to normal behavior, then calculating the distance between the image features and the cluster centers of the normal image clusters, and using the difference between this distance and a set distance threshold to characterize image anomalies. In another example, the preset image detection algorithm could also be a supervised machine learning model, such as using a Convolutional Neural Network (CNN) to extract deep features and then connecting them to a classifier to identify anomalies.

[0105] Image outliers are probability values ​​that characterize whether an image contains an anomaly. They can be values ​​between 0 and 1, with higher values ​​indicating a greater likelihood of an anomaly. Preset anomaly thresholds are pre-defined threshold values ​​for image outliers used to determine whether an image contains an anomaly.

[0106] Specifically, there are some differences in interaction patterns / rules between the interaction behaviors of normal users and abnormal users (see detailed explanation below), and these differences can be reflected in the constructed two-dimensional single-channel image. Therefore, after obtaining the two-dimensional single-channel image, the electronic device can first perform feature extraction processing to obtain the extracted image features. Then, using these image features as input data, a preset image detection algorithm is used for corresponding image processing, and the result is the image anomaly value of the two-dimensional single-channel image. Afterwards, the electronic device can compare the image anomaly value with a preset anomaly threshold. If the image anomaly value is less than the preset anomaly threshold, it can be considered that the two-dimensional single-channel image does not have image anomalies, and correspondingly, it can be determined that the target user does not exhibit abnormal behavior. Conversely, if the image anomaly value is greater than or equal to the preset anomaly threshold, it can be considered that the two-dimensional single-channel image has image anomalies, and correspondingly, it can be determined that the target user exhibits abnormal behavior.

[0107] Normal user interactions exhibit certain patterns / regularities. For example, within a specific timeframe, users may concentrate their clicks on certain specific locations, and the number of clicks conforms to general usage habits. However, abnormal user interactions are likely to disrupt these patterns / regularities. The following explains the patterns of normal and abnormal behavior under different image modes.

[0108] For the implementation of a two-dimensional single-channel image with time and position as the two-dimensional coordinate axes, the normal user interaction behavior is represented in the two-dimensional single-channel image as follows: Figure 2 The images show multiple pixels concentrated during daytime hours, with a relatively scattered pixel distribution and a fairly even number of clicks (pixel values ​​not differing much). However, abnormal users may exhibit highly regular clicking behavior during inactive periods, with a higher number of clicks at certain specific locations. These abnormal behaviors are shown in Figures 3(a) and 3(b) in a two-dimensional single-channel image. As shown in Figure 3(a), the clicking behavior is roughly evenly distributed across the entire time range, with significantly more clicks at certain locations (such as those with target encoding values ​​between 40 and 60, where larger pixel values ​​appear as darker pixels), and significantly fewer clicks at other locations (such as those with target encoding values ​​between 80 and 100, where smaller pixel values ​​appear as lighter pixels). As shown in Figure 3(b), although the click behavior was not evenly distributed across the entire time range, it still regularly occurred at certain fixed click locations during certain periods of the nighttime range. Furthermore, there were significantly more clicks at certain locations (such as those with target code values ​​between 40 and 60), while significantly fewer clicks were observed at other locations (such as those with target code values ​​between 80 and 100). These anomalous characteristics can be identified using image anomaly detection algorithms.

[0109] In the implementation of a two-dimensional single-channel image with time and frequency as the two-dimensional coordinate axes, the interaction behavior of normal users is shown in Figure 3(c). The pixels corresponding to the behavior positions are mainly concentrated in certain active periods during the day and evening, and these pixels are mainly distributed within a range with relatively small trigger counts. If the pixel value is a statistical count of the behavior positions, then considering that the number of behavior positions with nearly the same number of triggers by normal users in the same time period is not too large, the pixel values ​​of the behavior positions in the image will be within a relatively small range. However, the interaction behavior of abnormal users may be that the number of triggers of one or more behavior positions suddenly increases or decreases within a specific time period, and the interaction behavior pattern of other behavior positions is different. The distribution of pixels of the behavior positions corresponding to the interaction behavior of abnormal users in this image pattern may include the following. One image representation of abnormal behavior is: the pixels of multiple behavior positions are distributed in the inactive time period (such as late at night) as shown in area A of Figure 3(d), which reflects that the user frequently performs interactive operations during the inactive time period, and abnormal interaction behavior may have occurred. Another type of abnormal behavior can be visualized as follows: pixels at multiple behavior locations are distributed within the normal time period shown in region B of Figure 3(d), but the number of triggers at these locations significantly exceeds the normal trigger count, potentially indicating an abnormal burst of interactive behavior. Yet another type of abnormal behavior can be visualized as follows: as shown in region C of Figure 3(d), pixels at multiple behavior locations that should be distributed within the normal time period and normal trigger count are almost nonexistent, potentially indicating a prolonged period without interactive activity. A third type of abnormal behavior can be a combination of the situations shown in regions A and B of Figure 3(d), i.e., an abnormal burst of interactive behavior occurring within an inactive time period. In image representation where pixel values ​​represent the number of behavioral positions, another point of analysis for abnormal behavior could be: In a two-dimensional single-channel image, the pixel values ​​at a certain time axis scale and a certain number axis scale are excessively large (exceeding the range of pixel values ​​for normal interactive behavior). This indicates that the number of corresponding behavioral positions is too large. Reflected in interactive behavior, this means that nearly the same number of triggers are executed at multiple different behavioral positions within the same time period. This interactive behavior does not conform to normal user interaction and may indicate an abnormality of batch, explosive interactions. These abnormal characteristics can be identified using image anomaly detection algorithms.

[0110] For the implementation of a two-dimensional single-channel image with location and frequency dimensions as two-dimensional coordinate axes, the interaction behavior of normal users in the two-dimensional single-channel image is mainly as follows: the pixel values ​​(i.e., behavior time) corresponding to the same behavior location are distributed in certain active time periods during the day and evening; the trigger counts covered by each pixel corresponding to different behavior locations are evenly maintained within the normal numerical range. As shown in Figure 3(e), the pixel values ​​corresponding to the target encoding value 20 are mainly concentrated in the active periods of morning, noon, and evening. Due to the relatively large time span, the pixel values ​​increase continuously with the accumulation of triggers, with the maximum number of triggers at this behavior location remaining within 15. The pixel values ​​corresponding to the target encoding value 60 are mainly concentrated in the active period of evening. Due to the relatively small time span, the pixel values ​​increase continuously with the accumulation of triggers (in cases where the time period grouping granularity is small) or remain unchanged (in cases where the time period grouping granularity is large), with the maximum number of triggers at this behavior location remaining between 15 and 20. The pixel values ​​corresponding to the target encoding value 100 are mainly concentrated in the active period of morning. Due to the relatively small time span, the pixel values ​​increase continuously with the accumulation of triggers (in cases where the time period grouping granularity is small) or remain unchanged (in cases where the time period grouping granularity is large), with the maximum number of triggers at this behavior location remaining around 10. The distribution of these pixels and the changes in their pixel values ​​are consistent with the aforementioned behavioral patterns of normal users. However, the interaction behavior of abnormal users may differ from the normal interaction behavior pattern at a certain location due to variations in the timing of their actions. The distribution of pixels and / or changes in pixel values ​​corresponding to the interaction time of abnormal users in this image pattern may include the following: One type of abnormal behavior is shown in Figure 3(f), where the pixel values ​​of multiple action times corresponding to the target encoding value 20 consistently exhibit a lighter color as the number of triggers increases, indicating that these action times all fall within the late-night time period, reflecting the possibility of abnormal interaction during inactive periods at this location. Another type of abnormal behavior is shown in Figure 3(f), where the pixel values ​​of multiple action times corresponding to the target encoding value 60 transition from a lighter color to a darker color relatively evenly / regularly as the number of triggers increases, indicating that these action times relatively evenly cover various time periods throughout the day, reflecting the possibility of abnormal interaction during inactive periods at this location, as well as abnormal interaction with excessively uniform timing. Furthermore, the maximum number of triggers at this behavior location remained above 30, exceeding the range of normal interaction triggers, indicating that there may be an abnormal interaction with a sudden increase in the number of triggers at this behavior location.Another type of abnormal behavior is shown in Figure 3(f) as follows: among the pixel values ​​of multiple behavior times corresponding to template encoding value 100, only two behavior times fall within the active time period with darker color values ​​as the number of triggers accumulates. This reflects an interaction anomaly where the number of triggers may suddenly decrease at the behavior location. These abnormal characteristics can be identified using image anomaly detection algorithms.

[0111] The anomaly detection method provided in the above embodiments of this disclosure can acquire multiple target behavior data corresponding to a target user; the target behavior data includes target time features and target location features; determine the target trigger count corresponding to each target location feature, and digitize each target location feature to determine the target encoding value of the target location feature; based on the target encoding value, target trigger count, and target time features corresponding to each target behavior data, use any two dimensions of time dimension, count dimension, and location dimension as two-dimensional coordinate axes, and use the remaining dimension to represent the image pixel value, to construct a two-dimensional single-channel image corresponding to the target user; and use a preset image detection algorithm to detect the anomaly from the two-dimensional single-channel image. Image processing, which extracts image features from images, performs anomaly detection to generate image anomaly values. Based on these anomaly values ​​and a preset anomaly threshold, it determines whether a target user exhibits abnormal behavior. This method efficiently and conveniently converts multiple target behavior data from online programs into two-dimensional single-channel images according to their time, frequency, and location dimensions. Leveraging the high efficiency and accuracy of image anomaly detection, it simultaneously improves the precision and efficiency of anomaly detection. Furthermore, the universality of converting behavior data into two-dimensional single-channel images allows the anomaly detection method to be efficiently and flexibly adapted to various business scenarios, enhancing its versatility and flexibility.

[0112] Figure 4 This is a flowchart of another anomaly detection method provided in this disclosure. It further optimizes the step of "digitally processing the features of each target location to determine the target encoding value of the target location features." Furthermore, it can be further optimized by using "time and location dimensions as two-dimensional coordinate axes." Explanations of terms that are the same as or corresponding to those in the above embodiments are not repeated here. See also... Figure 4 The anomaly detection method includes:

[0113] S410. Obtain multiple target behavior data corresponding to the target user; the target behavior data includes target time features and target location features.

[0114] S420. Based on the target time characteristics, determine the number of target triggers corresponding to the target location characteristics.

[0115] S430. Based on the target location features, query the target mapping relationship and determine the target encoding value of the target location features.

[0116] The target mapping relationship is a pre-built data table used to record the one-to-one correspondence between the location features of each behavior and the encoded value of each behavior in the anomaly detection business scenario.

[0117] Specifically, the electronic device can read the target mapping relationship through local or external storage space. Then, it queries the target mapping relationship using the target location features as an index to find the behavior encoding value corresponding to the behavior location feature that matches the target location feature, and uses it as the target encoding value.

[0118] In some embodiments, prior to S430, the method further includes: determining each behavior location feature and the number of behavior triggers for each behavior location feature based on historical log data corresponding to the anomaly detection business scenario and behavior location information where the number of behavior triggers exceeds a preset threshold, and determining the behavior encoding value corresponding to the behavior location feature based on the sorted behavior location features and multiple preset encoding values, so as to construct a target mapping relationship.

[0119] The sorted behavior position features are obtained by reversing the order of behavior position features based on the number of behavior triggers.

[0120] Specifically, the electronic device can assign values ​​to each behavioral location feature using multiple pre-defined preset encoding values, which serve as its corresponding behavioral encoding values. First, the electronic device can obtain log data generated over a historical time period (hereinafter referred to as historical log data) based on the functions of online programs covered by the anomaly detection business scenario. Using behavioral location information where the number of triggers exceeds a preset threshold and / or preset behavioral location information, it extracts behavioral location features of multiple key behavioral locations from the historical log data. This filters out non-key behavioral locations, improving the data effectiveness of the subsequently constructed target mapping relationship and reducing the data volume of the target mapping relationship, thereby improving query efficiency. Then, the electronic device can count the number of times each behavioral location feature appears in the historical log data, which serves as the corresponding behavioral trigger count. Next, the electronic device can sort the behavioral location features in reverse order according to the number of behavioral triggers, obtaining the sorted behavioral location features. Finally, the electronic device can assign each preset encoding value to the sorted behavioral location feature in ascending order, thus obtaining the target mapping relationship where the data in the table has a one-to-one correspondence. This allows frequently triggered behavioral location features to have relatively small behavioral encoding values, concentrating the corresponding pixels within a specific area of ​​the image, thus highlighting image characteristics and further improving the accuracy of anomaly detection. Furthermore, manually pre-setting the encoding values ​​simplifies the process of digitizing behavioral locations, thereby improving the convenience and efficiency of constructing target mapping relationships.

[0121] In some other embodiments, prior to S430, the method further includes: determining the characteristics of each behavior location based on historical log data and behavior location information where the number of behavior triggers exceeds a preset threshold, and using a target conversion algorithm to digitize the behavior location characteristics to generate behavior encoding values ​​corresponding to the behavior location characteristics, so as to construct a target mapping relationship.

[0122] The target conversion algorithm is a pre-built algorithm capable of converting text / strings into a numerical value. In this embodiment, the target conversion algorithm includes a preset hash algorithm, a preset encoding algorithm based on Unicode or ASCII encoding, or a pre-trained machine learning model.

[0123] Specifically, in this embodiment, after the electronic device extracts each behavioral location feature according to the above description, it can use a target conversion algorithm to calculate the numerical value corresponding to each behavioral location feature, which serves as its corresponding behavioral encoding value, thereby constructing a one-to-one target mapping relationship between behavioral location features and behavioral encoding values. This can improve the flexibility and interpretability of location feature digitization.

[0124] S440. Based on the preset time granularity and / or the time range corresponding to the anomaly detection business scenario, construct the first coordinate range of the first coordinate axis corresponding to the time dimension.

[0125] The preset time granularity is the pre-defined unit of measurement for the time axis. The preset time granularity can be determined based on the computational speed required by the business needs and the computing power of the electronic equipment; for example, it could be a 1-minute granularity, a 10-minute granularity, etc. A smaller preset time granularity results in a larger image range for the 2D single-channel image, but the pixels corresponding to each target behavior data will be relatively sparse, leading to slower computation and making it difficult to train the anomaly detection algorithm / model. Conversely, a larger preset time granularity results in a smaller image range for the 2D single-channel image, but the pixels corresponding to each target behavior data will be relatively denser, providing a certain degree of distinguishability and resulting in faster computation, although some detail information may be lost. The time range corresponding to the anomaly detection business scenario is the time range set by the business requirements for anomaly detection, such as one day, three days, seven days, or one month, which can be determined based on the data volume. The first axis can be either the horizontal or vertical axis. The first coordinate range is the coordinate range of the first axis.

[0126] Specifically, in this embodiment, the first coordinate range can be constructed by specifying the scale unit and / or time range of the first coordinate axis.

[0127] In some embodiments, a first coordinate range corresponding to the first coordinate axis of the time dimension is constructed based on a preset time granularity and a configured time range. The electronic device can determine the scale unit of the first coordinate axis using the preset time granularity. Then, the default / configured time range is divided using this scale unit to obtain the first coordinate range corresponding to the first coordinate axis of the time dimension.

[0128] In other embodiments, a first coordinate range corresponding to the first coordinate axis of the time dimension is constructed based on the configured time granularity and the time range corresponding to the anomaly detection business scenario. The electronic device can determine the scale unit of the first coordinate axis using the default / configured time granularity. Then, the time range corresponding to the anomaly detection business scenario is divided using this scale unit to obtain the first coordinate range of the first coordinate axis corresponding to the time dimension.

[0129] In some other embodiments, a first coordinate range corresponding to the first coordinate axis of the time dimension is constructed based on a preset time granularity and the time range corresponding to the anomaly detection business scenario. The electronic device can divide the time range corresponding to the anomaly detection business scenario according to the preset time granularity to obtain the first coordinate range of the first coordinate axis corresponding to the time dimension. For example, if the time range corresponding to the anomaly detection business scenario is the number of minutes in a day, i.e., a time range of 1440 minutes, then dividing it according to a preset time granularity of 1 minute yields a first coordinate range of 0 to 1440, while dividing it according to a preset time granularity of 10 minutes yields a first coordinate range of 0 to 144.

[0130] S450. Based on the preset location granularity and / or the location encoding range corresponding to the anomaly detection business scenario, construct the second coordinate range of the second coordinate axis corresponding to the location dimension.

[0131] The preset position granularity is a pre-defined unit of measurement for the position coordinate axis. The preset position granularity can be determined based on the computational speed required by the business needs, the computational power of the electronic device, and the image requirements for two-dimensional single-channel images. The position encoding range corresponding to the anomaly detection business scenario is the range of behavior encoding values ​​corresponding to the positional features of each behavior covered by the anomaly detection business scenario. For example, if there are 1969 positional features covered by the anomaly detection business scenario, and each preset encoding value is 0 to 1968, then the position encoding range corresponding to the anomaly detection business scenario is 0 to 1968. The second coordinate axis is another coordinate axis in the two-dimensional coordinate system, which is perpendicular to the first coordinate axis. For example, when the first coordinate axis is the horizontal axis, the second coordinate axis is the vertical axis; conversely, when the first coordinate axis is the vertical axis, the second coordinate axis is the horizontal axis.

[0132] Specifically, in this embodiment, the second coordinate range can be constructed by specifying the scale unit and / or position encoding range of the second coordinate axis.

[0133] In some embodiments, a second coordinate range corresponding to the second coordinate axis of the position dimension is constructed based on a preset position granularity and a configured position encoding range. The electronic device can determine the scale unit of the second coordinate axis using the preset position granularity. Then, the default / configured position encoding range is divided using this scale unit to obtain the second coordinate range corresponding to the second coordinate axis of the position dimension.

[0134] In other embodiments, a second coordinate range corresponding to the second coordinate axis of the position dimension is constructed based on the configured position granularity and the position encoding range corresponding to the anomaly detection service scenario. The electronic device can determine the scale unit of the second coordinate axis using the default / configured position granularity. Then, the position encoding range corresponding to the anomaly detection service scenario is divided using this scale unit to obtain the second coordinate range of the second coordinate axis corresponding to the position dimension.

[0135] In some other embodiments, a second coordinate range corresponding to the second coordinate axis of the position dimension is constructed based on a preset position granularity and the position encoding range corresponding to the anomaly detection service scenario. The electronic device can obtain the second coordinate range of the second coordinate axis corresponding to the position dimension by dividing the position encoding range corresponding to the anomaly detection service scenario according to the preset position granularity.

[0136] In some embodiments, based on the location encoding range corresponding to the anomaly detection business scenario, a second coordinate range corresponding to the second coordinate axis of the location dimension is constructed, including: grouping the location encoding range based on the order of magnitude of the first coordinate range, so that the location encoding range is converted into a numerical range of the order of magnitude as the second coordinate range.

[0137] Specifically, in order to obtain a nearly square two-dimensional single-channel image for more efficient image processing by electronic devices, the horizontal and vertical axes can have coordinate ranges of the same order of magnitude. Therefore, the electronic device does not directly use the configured or preset position granularity, but determines the order of magnitude of the second coordinate range based on the order of magnitude of the first coordinate range, and then splits the position encoding range corresponding to the anomaly detection business scenario according to this order of magnitude to obtain the second coordinate range.

[0138] For example, if the first coordinate range is 0-1440 (thousands level), then the second coordinate range can also be set to the thousands level. In this case, the location coding range corresponding to the anomaly detection scenario can be directly used as the second coordinate range, i.e., 0-1968. Similarly, if the first coordinate range is 0-144 (hundreds level), then the second coordinate range can also be set to the hundreds level. This allows grouping the location coding range (0-1968) corresponding to the anomaly detection scenario so that the maximum value of the second coordinate range is as close as possible to 144. Thus, by grouping every 13 behavior coding values ​​according to the order of the location coding range, the second coordinate range 0-151 can be obtained.

[0139] By synchronizing the coordinate ranges of the horizontal and vertical axes as described above, the consistency of feature scales in each dimension of the two-dimensional single-channel image is improved. This avoids feature scale deviations in different dimensions, enabling the anomaly detection algorithm to detect abnormal behavior in each dimension in a balanced manner, highlighting real anomalies, and further improving the accuracy of anomaly detection.

[0140] S460. Using time and location dimensions as two-dimensional coordinate axes and the number of times dimension to represent the image pixel value, the target encoding value and target time feature corresponding to each target behavior data are mapped to pixel units, and the target trigger number corresponding to the corresponding target behavior data is mapped to the pixel value of the pixel unit to construct a two-dimensional single-channel image corresponding to the target user.

[0141] S470. Using a preset image detection algorithm, perform image processing to detect anomalies in the image features extracted from the two-dimensional single-channel image, generate image anomaly values, and determine whether the target user has abnormal behavior based on the image anomaly values ​​and the preset anomaly threshold.

[0142] The above-described technical solution of this disclosure determines the target encoding value of the target location feature by querying the target mapping relationship based on the target location feature; it realizes the digital processing of the target location feature by means of table lookup, thereby improving the efficiency of location feature digitization and further improving the efficiency of abnormal behavior detection. By constructing a first coordinate range corresponding to the first coordinate axis of the time dimension based on a preset time granularity and / or the time range corresponding to the anomaly detection business scenario; and constructing a second coordinate range corresponding to the second coordinate axis of the location dimension based on a preset location granularity and / or the location encoding range corresponding to the anomaly detection business scenario; it realizes the construction of a more reasonable horizontal and vertical coordinate range according to the preset coordinate granularity and / or the anomaly detection business scenario, improving the accuracy of the two-dimensional single-channel image in representing target behavior data, thereby further improving the accuracy of behavior anomaly detection.

[0143] Figure 5 This is a schematic diagram of an anomaly detection device provided in an embodiment of this disclosure. Figure 5 As shown, the anomaly detection device 500 includes:

[0144] The target behavior data acquisition module 510 is used to acquire multiple target behavior data corresponding to the target user; wherein, the target behavior data includes target time features and target location features; the target time features include the characteristics of the target behavior in the time dimension; the target location features include the characteristics of the trigger location of the interactive operation corresponding to the target behavior;

[0145] The target trigger count determination module 520 is used to determine the target trigger count corresponding to the target location characteristics based on the target time characteristics;

[0146] The target encoding value determination module 530 is used to digitize the features of each target location and determine the target encoding value of the target location features;

[0147] The two-dimensional single-channel image construction module 540 is used to construct a two-dimensional single-channel image corresponding to the target user based on the target encoding value, target trigger count and target time feature corresponding to each target behavior data, using any two of the time dimension, count dimension and position dimension as two-dimensional coordinate axes, and using the remaining dimension to represent the image pixel value.

[0148] The abnormal behavior detection module 550 is used to perform image processing on image features extracted from a two-dimensional single-channel image using a preset image detection algorithm, generate image anomaly values, and determine whether the target user has abnormal behavior based on the image anomaly values ​​and a preset anomaly threshold.

[0149] The anomaly detection device provided in the above embodiments of this disclosure is capable of acquiring multiple target behavior data corresponding to a target user; the target behavior data includes target time features and target location features; based on the target time features, the number of target triggers corresponding to the corresponding target location features is determined, and each target location feature is digitized to determine the target encoding value of the target location feature; based on the target encoding value, the number of target triggers, and the target time features corresponding to each target behavior data, any two dimensions of time dimension, number dimension, and location dimension are used as two-dimensional coordinate axes, and the remaining dimensions are used to represent image pixel values ​​to construct a two-dimensional single-channel image corresponding to the target user; using a preset image detection algorithm, the device detects the target behavior data. Image processing, which extracts image features from two-dimensional single-channel images for anomaly detection, generates image anomaly values. Based on these anomaly values ​​and a preset anomaly threshold, it determines whether a target user exhibits abnormal behavior. This method efficiently and conveniently converts multiple target behavior data of a target user in an online program into two-dimensional single-channel images according to their time, frequency, and location dimensions. Leveraging the high efficiency and accuracy of image anomaly detection, it simultaneously improves the accuracy and efficiency of anomaly behavior detection. Furthermore, the universality of converting behavior data into two-dimensional single-channel images allows the anomaly detection method to be efficiently and flexibly adapted to various business scenarios, enhancing the universality and flexibility of anomaly detection.

[0150] In some embodiments, the two-dimensional single-channel image construction module 540 is specifically used for:

[0151] Using time and location as two-dimensional coordinate axes and the number of times as the dimension to represent the image pixel value, the target encoding value and target time feature corresponding to each target behavior data are mapped to pixel units, and the target trigger number corresponding to the corresponding target behavior data is mapped to the pixel value of the pixel unit to construct a two-dimensional single-channel image corresponding to the target user.

[0152] In other embodiments, the two-dimensional single-channel image construction module 540 is specifically used for:

[0153] Using time and frequency dimensions as two-dimensional coordinate axes and position dimension to represent image pixel values, the target trigger count and target time features corresponding to the target behavior data are mapped to pixel units, and the target encoding value corresponding to the target behavior data is mapped to the pixel value of the pixel unit to construct a two-dimensional single-channel image corresponding to the target user.

[0154] In some other embodiments, the two-dimensional single-channel image construction module 540 is specifically used for:

[0155] Using location and frequency dimensions as two-dimensional coordinate axes and time dimension to represent image pixel values, the target encoding value and target trigger count corresponding to the target behavior data are mapped to pixel units, and the target time feature corresponding to the target behavior data is mapped to the pixel value of the pixel unit to construct a two-dimensional single-channel image corresponding to the target user.

[0156] In some embodiments, the anomaly detection device 500 further includes a coordinate range determination module, used for:

[0157] Before constructing a two-dimensional single-channel image of the target user, with time and location dimensions as two-dimensional coordinate axes, and the number of times representing the image pixel value, the target encoding value and target time feature corresponding to each target behavior data are mapped to pixel units, and the target trigger count corresponding to the corresponding target behavior data is mapped to the pixel value of the pixel unit, the first coordinate range corresponding to the first coordinate axis of the time dimension is constructed based on the preset time granularity and / or the time range corresponding to the anomaly detection business scenario.

[0158] Based on the preset location granularity and / or the location encoding range corresponding to the anomaly detection business scenario, a second coordinate range corresponding to the second coordinate axis of the location dimension is constructed; wherein, the first coordinate axis and the second coordinate axis are perpendicular to each other.

[0159] In some embodiments, the coordinate range determination module is specifically used for:

[0160] Based on the order of magnitude of the first coordinate range, the location coding range is grouped to convert the location coding range into a numerical range of the same order of magnitude, which serves as the second coordinate range.

[0161] In some embodiments, the target behavior data acquisition module 510 is specifically used for:

[0162] Obtain the raw log data corresponding to the anomaly detection business scenario, and filter the target behavior data from the raw log data based on the behavior location information where the number of behavior triggers exceeds a preset threshold; where the number of behavior triggers is the total number of times the behavior location is triggered at each behavior time.

[0163] In some embodiments, the target encoded value determination module 530 is specifically used for:

[0164] Based on the target location features, the target mapping relationship is queried to determine the target encoding value of the target location features; wherein, the target mapping relationship records the one-to-one correspondence between the location features of each behavior and the encoding value of each behavior in the anomaly detection business scenario.

[0165] In some embodiments, the anomaly detection device 500 further includes a target mapping relationship construction module, used for:

[0166] Before determining the target encoding value of the target location feature by querying the target mapping relationship based on the target location feature, the system determines each behavior location feature and the behavior trigger count of each behavior location feature based on the historical log data corresponding to the anomaly detection business scenario and the behavior location information of the behavior trigger count exceeding the preset threshold. Then, based on the sorted behavior location features and multiple preset encoding values, the system determines the behavior encoding value corresponding to the behavior location feature to construct the target mapping relationship. The sorted behavior location features are obtained by reversing the order of each behavior location feature based on the behavior trigger count.

[0167] Alternatively, before querying the target mapping relationship based on the target location features and determining the target encoding value of the target location features, based on the historical log data corresponding to the anomaly detection business scenario and the behavior location information where the number of behavior triggers exceeds a preset threshold, determine the behavior location features, and use a target conversion algorithm to digitize the behavior location features to generate the behavior encoding value corresponding to the behavior location features in order to construct the target mapping relationship; wherein, the target conversion algorithm includes a preset hash algorithm, a preset encoding algorithm, or a machine learning model.

[0168] In some embodiments, the target behavior data includes click behavior data, the target time feature includes click time, and the target location feature includes the clicked page path and the clicked area on the page.

[0169] The anomaly detection device provided in this disclosure can execute the anomaly detection method provided in any embodiment of this disclosure, and has the corresponding functional modules and beneficial effects of the execution method.

[0170] It is worth noting that in the embodiments of the above-mentioned anomaly detection device, the modules included are divided according to functional logic, but are not limited to the above division, as long as the corresponding functions can be achieved; in addition, the specific names of each functional module are only for easy differentiation and are not used to limit the scope of protection of this disclosure.

[0171] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this disclosure. Figure 6 As shown, the electronic device 600 includes one or more processors 601 and memory 602.

[0172] The processor 601 may be a central processing unit (CPU) or other form of processing unit with data processing capabilities and / or instruction execution capabilities, and may control other components in the electronic device 600 to perform desired functions.

[0173] The memory 602 may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. Volatile memory may include, for example, random access memory (RAM) and / or cache memory. Non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc. One or more computer program instructions may be stored on the computer-readable storage medium, and the processor 601 may execute the program instructions to implement the anomaly detection method and / or other desired functions described in the embodiments of this disclosure. Various contents such as target mapping relationships, horizontal axis ranges, and vertical axis ranges may also be stored in the computer-readable storage medium.

[0174] In one example, electronic device 600 may further include an input device 603 and an output device 604, these components being interconnected via a bus system and / or other forms of connection mechanisms (not shown). The input device 603 may include, for example, a keyboard, a mouse, etc. The output device 604 may output various information to the outside, including two-dimensional single-channel images, anomaly detection results, etc. The output device 604 may include, for example, a display, a speaker, a printer, and a communication network and its connected remote output devices, etc.

[0175] Of course, for the sake of simplicity, Figure 6 Only some of the components of the electronic device 600 relevant to this disclosure are shown, omitting components such as buses, input / output interfaces, etc. In addition, the electronic device 600 may include any other suitable components depending on the specific application.

[0176] In addition to the methods and devices described above, embodiments of this disclosure may also be computer program products, which include computer program instructions that, when executed by a processor, cause the processor to perform the anomaly detection method provided in the embodiments of this disclosure.

[0177] Computer program products can be written in any combination of one or more programming languages ​​to perform the operations of embodiments of this disclosure. The programming languages ​​include object-oriented programming languages ​​such as Java and C++, as well as conventional procedural programming languages ​​such as C or similar languages. The program code can be executed entirely on a user's computing device, partially on a user's computing device, as a standalone software package, partially on a user's computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0178] Furthermore, embodiments of this disclosure may also be computer-readable storage media storing computer program instructions that, when executed by a processor, cause the processor to perform the anomaly detection method provided in embodiments of this disclosure.

[0179] The computer-readable storage medium may be any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may, for example, include, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatuses, or devices, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: electrical connections having one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0180] It should be noted that the terminology used in this disclosure is for the purpose of describing specific embodiments only and is not intended to limit the scope of this application. As shown in this disclosure and the claims, unless the context clearly indicates otherwise, the words "a," "an," "an," and / or "the" are not specifically singular and may include plural forms. The term "and / or" includes any one and all combinations of one or more of the associated listed items. The terms "comprising," "including," or any other variations thereof are intended to cover a non-exclusive inclusion, such that a process, method, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, or apparatus. Without further limitations, an element defined by the phrase "comprising an..." does not exclude the presence of other identical elements in the process, method, or apparatus that includes said element.

[0181] The above description is merely a specific embodiment of this disclosure, enabling those skilled in the art to understand or implement it. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this disclosure. Therefore, this disclosure is not to be limited to the embodiments described herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. An anomaly detection method, characterized in that, include: Acquire multiple target behavior data corresponding to the target user; wherein, the target behavior data includes target time features and target location features; the target time features include the characteristics of the target behavior in the time dimension; the target location features include the characteristics of the trigger location of the interactive operation corresponding to the target behavior; Based on the target time characteristics, determine the number of target triggers corresponding to the corresponding target location characteristics; The target location features are digitally processed to determine the target encoding value of the target location features; Based on the target encoding value, the number of target triggers and the target time features corresponding to each target behavior data, a two-dimensional single-channel image corresponding to the target user is constructed by using any two of the time dimension, the number of times dimension and the location dimension as two-dimensional coordinate axes and the remaining dimension to represent the image pixel value. Using a preset image detection algorithm, image processing is performed on the image features extracted from the two-dimensional single-channel image to detect anomalies, generating image anomaly values. Based on the image anomaly values ​​and a preset anomaly threshold, it is determined whether the target user exhibits abnormal behavior.

2. The method according to claim 1, characterized in that, The method of constructing a two-dimensional single-channel image corresponding to the target user based on the target encoding value, the number of target triggers, and the target time features corresponding to each of the target behavior data, using any two dimensions of time, number of triggers, and location as two-dimensional coordinate axes, and using the remaining dimensions to represent image pixel values, includes: Using the time dimension and the location dimension as the two-dimensional coordinate axes, and the number dimension to represent the image pixel value, the target encoding value and the target time feature corresponding to each target behavior data are mapped to pixel units, and the target trigger count corresponding to the corresponding target behavior data is mapped to the pixel value of the pixel unit to construct the two-dimensional single-channel image corresponding to the target user.

3. The method according to claim 1, characterized in that, The method of constructing a two-dimensional single-channel image corresponding to the target user based on the target encoding value, the number of target triggers, and the target time features corresponding to each of the target behavior data, using any two dimensions of time, number of triggers, and location as two-dimensional coordinate axes, and using the remaining dimensions to represent image pixel values, includes: Using the time dimension and the number of times dimension as the two-dimensional coordinate axes, and the position dimension to represent the image pixel value, the target trigger count and the target time feature corresponding to the corresponding target behavior data are mapped to pixel units, and the target encoding value corresponding to the corresponding target behavior data is mapped to the pixel value of the pixel unit to construct the two-dimensional single-channel image corresponding to the target user.

4. The method according to claim 1, characterized in that, The method of constructing a two-dimensional single-channel image corresponding to the target user based on the target encoding value, the number of target triggers, and the target time features corresponding to each of the target behavior data, using any two dimensions of time, number of triggers, and location as two-dimensional coordinate axes, and using the remaining dimensions to represent image pixel values, includes: Using the location dimension and the number of times dimension as the two-dimensional coordinate axes, and the time dimension to represent the image pixel value, the target encoding value and the number of target triggers corresponding to the corresponding target behavior data are mapped to pixel units, and the target time feature corresponding to the corresponding target behavior data is mapped to the pixel value of the pixel unit to construct the two-dimensional single-channel image corresponding to the target user.

5. The method according to claim 2, characterized in that, Before constructing the two-dimensional single-channel image corresponding to the target user, using the time dimension and the position dimension as the two-dimensional coordinate axes, the number dimension to represent the image pixel value, mapping the target encoding value and the target time feature corresponding to each target behavior data to pixel units, and mapping the target trigger count corresponding to the corresponding target behavior data to the pixel value of the pixel unit, the method further includes: Based on the preset time granularity and / or the time range corresponding to the anomaly detection business scenario, construct the first coordinate range of the first coordinate axis corresponding to the time dimension; Based on the preset location granularity and / or the location encoding range corresponding to the anomaly detection business scenario, a second coordinate range corresponding to the second coordinate axis of the location dimension is constructed; wherein, the first coordinate axis and the second coordinate axis are perpendicular to each other.

6. The method according to claim 5, characterized in that, Based on the location encoding range corresponding to the anomaly detection business scenario, a second coordinate range for the second coordinate axis corresponding to the location dimension is constructed, including: Based on the order of magnitude of the first coordinate range, the location encoding range is grouped to convert the location encoding range into a numerical range of the order of magnitude, which is then used as the second coordinate range.

7. The method according to claim 1, characterized in that, The acquisition of multiple target behavior data corresponding to the target user includes: Obtain the raw log data corresponding to the anomaly detection business scenario, and filter the target behavior data from the raw log data based on the behavior location information where the number of behavior triggers exceeds a preset threshold; wherein, the number of behavior triggers is the total number of times the behavior location is triggered at each behavior time.

8. The method according to claim 1, characterized in that, The step of digitally processing each of the target location features to determine the target encoding value of the target location feature includes: Based on the target location features, the target mapping relationship is queried to determine the target encoding value of the target location features; wherein, the target mapping relationship records the one-to-one correspondence between the location features of each behavior and the encoding value of each behavior in the anomaly detection business scenario.

9. The method according to claim 8, characterized in that, Before determining the target encoding value of the target location features by querying the target mapping relationship based on the target location features, the method further includes: Based on the historical log data and behavior location information where the number of behavior triggers exceeds a preset threshold corresponding to the anomaly detection business scenario, each behavior location feature and the number of behavior triggers for each behavior location feature are determined. Based on the sorted behavior location features and multiple preset encoding values, the behavior encoding value corresponding to each behavior location feature is determined to construct the target mapping relationship. The sorted behavior location features are obtained by reversing the order of each behavior location feature based on the number of behavior triggers. Alternatively, based on historical log data and behavior location information where the number of triggers exceeds a preset threshold corresponding to the anomaly detection business scenario, each behavior location feature is determined, and a target conversion algorithm is used to digitize the behavior location features to generate the behavior encoding value corresponding to the behavior location feature, so as to construct the target mapping relationship; wherein, the target conversion algorithm includes a preset hash algorithm, a preset encoding algorithm, or a machine learning model.

10. The method according to claim 1, characterized in that, The target behavior data includes click behavior data, the target time feature includes click time, and the target location feature includes the click page path and the page click area.

11. An anomaly detection device, characterized in that, include: The target behavior data acquisition module is used to acquire multiple target behavior data corresponding to a target user; wherein, the target behavior data includes target time features and target location features; the target time features include the characteristics of the target behavior in the time dimension; the target location features include the characteristics of the trigger location of the interactive operation corresponding to the target behavior; The target trigger count determination module is used to determine the target trigger count corresponding to the target location characteristics based on the target time characteristics; The target encoding value determination module is used to perform digital processing on each of the target location features and determine the target encoding value of the target location feature; A two-dimensional single-channel image construction module is used to construct a two-dimensional single-channel image corresponding to the target user based on the target encoding value, the number of target triggers and the target time features corresponding to each target behavior data, using any two of the time dimension, the number dimension and the position dimension as two-dimensional coordinate axes, and using the remaining dimension to represent the image pixel value. The abnormal behavior detection module is used to perform image processing on the image features extracted from the two-dimensional single-channel image using a preset image detection algorithm, generate image anomaly values, and determine whether the target user has abnormal behavior based on the image anomaly values ​​and a preset anomaly threshold.

12. An electronic device, characterized in that, The electronic device includes: Processor and memory; The processor executes the anomaly detection method as described in any one of claims 1 to 10 by calling the program or instructions stored in the memory.

13. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a program or instructions that cause a computer to perform the anomaly detection method as described in any one of claims 1 to 10.

14. A computer program product, characterized in that, The computer program product is used to implement the anomaly detection method as described in any one of claims 1 to 10.

Images