WO2016188334A1 - 一种用于处理应用访问数据的方法与设备 - Google Patents

一种用于处理应用访问数据的方法与设备 Download PDF

Info

Publication number
WO2016188334A1
WO2016188334A1 PCT/CN2016/082161 CN2016082161W WO2016188334A1 WO 2016188334 A1 WO2016188334 A1 WO 2016188334A1 CN 2016082161 W CN2016082161 W CN 2016082161W WO 2016188334 A1 WO2016188334 A1 WO 2016188334A1
Authority
WO
WIPO (PCT)
Prior art keywords
event
application
application access
information
access data
Prior art date
Application number
PCT/CN2016/082161
Other languages
English (en)
French (fr)
Inventor
贾宇
Original Assignee
阿里巴巴集团控股有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 阿里巴巴集团控股有限公司 filed Critical 阿里巴巴集团控股有限公司
Publication of WO2016188334A1 publication Critical patent/WO2016188334A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/90—Details of database functions independent of the retrieved data types
    • G06F16/95—Retrieval from the web
    • G06F16/958—Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking
    • G06F16/972—Access to data in other repository systems, e.g. legacy data or dynamic Web page generation

Definitions

  • the present application relates to the field of computers, and in particular, to a technology for processing application access data.
  • the target users In the Internet scenario, it is often desirable to classify the target users accurately based on certain purposes. For example, based on various dimensions, the visitors of the website are divided accordingly, and the dimensions may include user preferences, user identities, and the like. The information can be further processed and analyzed based on the segmentation result, such as providing differentiated services to the target user. For example, the real user and the fake user of the website are identified based on the information corresponding to the behavior of the user browsing the webpage.
  • the existing user identification scheme mainly relies on user browser information, such as user information based on cookie information of the user's browser, and the user identification corresponding to the mobile application, such as the identification of the true and false users of the mobile application, due to There is no user browser behavior that can be relied upon, so there is no corresponding effective identification method.
  • a method for processing application access data on a network device side includes:
  • the application access data is processed based on corresponding event description information to determine event feature information regarding an application access event of the target application.
  • a method for processing application access data on a user equipment side comprising:
  • a network device for processing application access data includes:
  • a first device configured to acquire application access data about a target application in a corresponding user equipment
  • a second device configured to process the application access data based on the corresponding event description information to determine event feature information about an application access event of the target application.
  • a user equipment for processing application access data is further provided, where the user equipment includes:
  • a ninth device configured to acquire event description information about a target application on the user equipment provided by the corresponding network device
  • a tenth device configured to set an acquisition trigger condition for application access data of the target application based on the event description information
  • An eleventh device configured to collect the application access data based on the collection trigger condition
  • the twelfth device is configured to send the application access data to the network device.
  • a system for processing application access data comprising: a network device for processing application access data according to a further aspect of the present application, And a user equipment for processing application access data according to still another aspect of the present application.
  • the network device of the present application processes the application access data of the target application in the acquired user equipment by using the corresponding event description information to determine event feature information of the application access event of the target application.
  • the application access data for obtaining the event description can be obtained in a targeted manner, and statistically analyzed, thereby providing a favorable data foundation for subsequent information processing and application.
  • the information classification and recognition under various specific application scenarios can be flexibly implemented.
  • the credibility information of the visitor can be determined, so that the authentic credential information of the user in the application can be more realistically reflected, thereby being better. Maintain, improve, and improve the application of the target application. Further, the present application generates corresponding graphical information based on the event feature information, so that the event feature information can be more visually and intuitively described by means of the graphical information. Further, in the present application, the user equipment sets an acquisition trigger condition of the application access data in the target application in advance based on the event description information, so that the application access data can be effectively obtained through a targeted burying point, and further Provide a favorable data foundation for subsequent statistical analysis of data.
  • FIG. 1 shows a schematic diagram of an apparatus for processing a network device for accessing data of an application according to an aspect of the present application
  • FIG. 2 is a schematic diagram of an apparatus for processing a network device for accessing data by an application according to a preferred embodiment of the present application
  • FIG. 3 is a schematic diagram of a system for processing network devices and user equipment for application access data according to a preferred embodiment of the present application
  • FIG. 4 is a schematic diagram of a device of a network device for processing an application access data by a user according to another preferred embodiment of the present application;
  • FIG. 5 is a schematic diagram of a method for processing application access data on a network device side according to still another aspect of the present application.
  • FIG. 6 is a schematic diagram of a method for processing application access data on a network device side according to a preferred embodiment of the present application
  • FIG. 7 shows a schematic diagram of a method for processing application access data in accordance with a preferred embodiment of the present application
  • FIG. 8 is a schematic diagram of a method for processing application access data on a network device side according to another preferred embodiment of the present application.
  • the terminal, the device of the service network, and the trusted party each include one or more processors (CPUs), input/output interfaces, network interfaces, and memory.
  • processors CPUs
  • input/output interfaces network interfaces
  • memory volatile and non-volatile memory
  • the memory may include non-persistent memory, random access memory (RAM), and/or non-volatile memory in a computer readable medium, such as read only memory (ROM) or flash memory.
  • RAM random access memory
  • ROM read only memory
  • Memory is an example of a computer readable medium.
  • Computer readable media includes both permanent and non-persistent, removable and non-removable media.
  • Information storage can be implemented by any method or technology.
  • the information can be computer readable instructions, data structures, modules of programs, or other data.
  • Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read only memory (ROM), electrically erasable programmable read only memory (EEPROM), flash memory, or other Memory technology, CD-ROM, digital versatile disc (DVD) or other optical storage, magnetic tape cartridge, tape storage or other magnetic storage device or any other non-transportable media for storage Information that can be accessed by a computing device.
  • computer readable media does not include non-transitory computer readable media, such as modulated data signals and carrier waves.
  • the network device 1 shows a schematic diagram of a device of a network device 1 for processing application access data in accordance with an aspect of the present application.
  • the network device 1 includes a first device 101 and a second device 102.
  • the first device 101 acquires application access data about the target application in the corresponding user equipment; the second device 102 processes the application access data based on the corresponding event description information to determine an application access event about the target application. Event feature information.
  • the first device 101 of the network device 1 acquires application access data about a target application in the corresponding user equipment.
  • the user equipment includes, but is not limited to, various types of PCs, mobile phones, tablets, and other various terminal devices that can load corresponding target applications.
  • the target applications include, but are not limited to, application types corresponding to various terminal devices.
  • the target application corresponds to the user equipment, and the terminal device is a mobile terminal, such as a mobile phone, a tablet computer, etc., and the target application may be ipa, pxl, deb based on the Apple iOS system.
  • Applications such as formats can also be based on the Android apk format application, or can be based on the xap format of the Microsoft Windows Phone system, and so on.
  • the application access data includes access related information determined based on an access operation performed by the user in the target application of the terminal device.
  • the access operation includes a user clicking into a certain page of the application, clicking a certain control of the application, and the like, and based on the access operation, the access data includes page information of the user accessing the application, and the time the user stays on the page. The number of times the user clicks on the corresponding control in the application, the user accesses the traffic information consumed by the application within a certain period of time, and the like.
  • the specific type of access data acquired by the network device 1 can be set based on actual needs.
  • the access related information corresponding to all access operations of the application by the user may be included in the application access data acquired by the network device 1 in an indiscriminate manner; for example, the characteristics of different target applications may also be targeted.
  • the type and content of the corresponding application access data are set. For example, the type and content of the application access data may be determined in a targeted manner based on the actual application scenario after the application access data processing.
  • the acquisition of the application access data may be periodically acquired, or other acquisition conditions may be set according to an actual application scenario.
  • the application access data may be directly obtained from a user equipment corresponding to the target application.
  • the application access data may be obtained by reading an application access log corresponding to the target application.
  • the application access data may also obtain the application access data from a third-party device corresponding to the target device, where the third-party device includes a device capable of acquiring and storing the application access data.
  • the second device 102 processes the application access data based on the corresponding event description information to determine event feature information about the application access event of the target application.
  • the application access data acquired by the network device 1 includes access related information determined based on an access operation performed by the user in the target application of the terminal device.
  • the corresponding application access event is defined based on the user's access operation to the application. For example, if the user clicks the login key to log in to the application, the corresponding application access event can be defined as the login.
  • one access operation may correspond to one or more application access events. For example, when the user clicks into a page, the application access event may be corresponding to the login page information and the login page number.
  • the definition of the application access event may be set based on the running characteristics of the actual application or based on the needs of the actual application scenario after the application access data processing of the target application.
  • the event description information corresponds to the application access event
  • the event description information includes a specific description of the application access event.
  • the event description information may include the application access event.
  • the event name of the application access event may be any string that can uniquely determine the event;
  • the description content of the application access event may be any string, the purpose of which is to help distinguish the specific content of the event;
  • the processing information of the application access event may include operation information, and the purpose is to perform feature quantization on the application access event, for example, may be a quantity operation of an event content, a sum operation, an averaging operation, and the like.
  • the operation name of the application access event is A1
  • the description content of the application access event is login
  • the processing information of the application access event is set to be calculated. Subcount, here, the counter is calculated corresponding to the number of logins.
  • the event description information corresponding to the target application may be obtained by the network device 1 from any possible server device.
  • the event description information corresponding to the target application may also be determined by the application developer according to actual conditions. It is required to be directly set in the network device 1. Further, a corresponding plurality of application access events may be separately set for each target application, and corresponding event description information is set.
  • different target applications, or different kinds of target applications may correspond to different or the same application access events or event description information settings.
  • the processing by the second device 102 of the network device 1 for the application access data based on the event description information may include matching the obtained application access data with corresponding event description information, if it is a match If the success is successful, the corresponding event feature information is determined based on a calculation or a statistical analysis manner corresponding to the application access event preset in the event description information.
  • the application access data may be processed differently based on the different forms of content of the application access data. For example, when the application access data is an application access log from the user device where the target application is located, if a row of logs is read, the string corresponding to the row log may be first decomposed based on a preset delimiter.
  • the application access data may be an undefined application access event, and no processing is ignored.
  • the network device 1 of the present application processes the application access data of the target application in the acquired user equipment based on the corresponding event description information to determine event feature information of the application access event of the target application.
  • the event feature information may reflect the relevant situation of the target application in the corresponding access operation in a user equipment, apply an event feature information analysis to a target, or comprehensively analyze a plurality of event feature information, which may provide subsequent information processing and application.
  • a favorable data base For example, if the same application on different devices or the same application access event of the same application is comparable, the same application or the same application can access the difference of the event feature information corresponding to the event or the similarity analysis, and then The application access event corresponding to the event feature information is differentiated and identified accordingly.
  • the second device of the network device 1 comprises a first unit (not shown) and a second unit (not shown), wherein the first unit accesses data to the application based on the event description information Log analysis is performed to obtain one or more application access events for the target application; the second unit performs statistical processing on the one or more application access events to obtain corresponding event feature information.
  • the first unit performs log analysis on the application access data based on the event description information to obtain one or more application access events related to the target application.
  • the application access data acquired by the network device 1 may have multiple forms of content, and different forms of application access data may correspond to different data processing.
  • the application access log corresponding to the application access data is obtained based on the log statistics service set by the user equipment corresponding to the target application, and the target is determined based on log analysis of the application access log. Apply the corresponding application access event.
  • the application access log itself corresponds to non-translated text File, but it contains information that can be structured.
  • the log analysis includes: performing a line-by-line decomposition on the application access log, and then determining an application access event corresponding to the target application based on the result of the decomposition and combining the event description information.
  • the application access logs of different formats need to be corresponding to different log parsing rules, and the application access logs are parsed according to existing or customized log parsing rules.
  • the application access log obtained is read line by line.
  • each line of logs corresponds to an application access event. If there are multiple access operation information, it may be recorded in multiple logs.
  • the application access log is decomposed according to a predefined delimiter, and the decomposed character substrings may respectively correspond to corresponding application access events, or the contents of the plurality of character substrings may correspond to
  • An application access event is compared with the application access event defined in the event description information corresponding to the target application, so as to record an application access event that needs to be retained in the application access log.
  • the application access event corresponding to the character substring is compared with the application access event defined in the event description information corresponding to the target application, and may be performed based on the same or similar event description information.
  • the The application access event obtained by the network device 1 and the application access event corresponding to the application access event are matched according to the customized event name.
  • the event name of an application access event corresponds to a unique string B1.
  • the related information such as the event name in the application access log may be set in a predetermined format before the user equipment collects the application access data.
  • the user equipment collects a burying point based on event description information of the target application acquired from the network device 1, and further, when collecting application access data, each application access event in the corresponding application access log information is A unique event name is recorded for the corresponding record. Therefore, based on the event name information, it may be determined which application access data corresponding to the target application in the application access data is set.
  • the second unit performs statistical processing on the one or more application access events to obtain corresponding event feature information.
  • the application access event may be calculated and statistically processed based on the event description information corresponding to the application access event.
  • the specific statistical processing method depends on the setting of the event description information.
  • the event feature information that is, the result of processing the application access event based on the event description information, preferably, the event feature information may further include a statistical result of processing results of several same application access events. .
  • the event description information includes qualitatively determining the application access event, determining, according to the qualitative judgment information, the nature of the application access event, and thereby using the event feature information of the application access event.
  • the event description information includes quantitative analysis of the application access event, for example, if the content of the application access event is not limited to a quantity operation, a sum operation, an averaging operation, or the like, Based on the corresponding operational information
  • the application access event performs feature quantization to determine the quantized result of each application access event as event feature information.
  • the event description information includes operator information corresponding to the event, wherein the second unit accesses the one or more applications based on the operator information corresponding to the application access event.
  • the event is statistically processed to obtain corresponding event feature information.
  • the operator information includes operations that are not limited to a quantity operation, a summation operation, an averaging operation, and the like, and correspond to the operators count, sum, avg, and the like, respectively.
  • the target application exists on the device a1
  • the corresponding application access event C1 is determined, and the content description is the access page x, and the corresponding operator information is count, based on the event.
  • the event characteristic information of the corresponding event may be: an application access event C1:n, where n may be the number of times the user accesses the page x within a certain event.
  • the quantized event feature information may correspond to different quantization units.
  • the event feature information time dimension may be customized in the event description information, for example, by default, the log time may be included in the application access log, and a specific time is added in the log parsing process. Code logic to define time to meet actual needs.
  • the network device 1 further includes a third device (not shown) for generating corresponding graphical information based on the event feature information and displaying the graphical information.
  • a third device (not shown) for generating corresponding graphical information based on the event feature information and displaying the graphical information.
  • the graphic information includes, but is not limited to, various types of graphic description information such as a histogram, a pie chart, and the like.
  • a histogram can be used as an image for describing various feature sets.
  • the histogram corresponding to the event feature information may be directly input into the target recognition classifier for subsequent segmentation recognition.
  • the defined application access event may not be limited to a specific form, and any form-defined application access event may be displayed intuitively and conveniently through the graphical information.
  • a more intuitive visual comparison of the differences between event feature information can also be performed.
  • the method may be based on the certain clustering criterion, for example, based on a certain distance algorithm, such as determining the visitor.
  • a certain distance algorithm such as determining the visitor.
  • the multi-class users are automatically classified according to the established distance.
  • the event feature information corresponding to the visitor has corresponding histogram information, it can be directly based on the The histogram distance between visitors is used to classify the visitors.
  • the network device 1 includes a seventh device 201, an eighth device 202, a first device 203, and a Second device 204.
  • the seventh device 201 acquires the event description information corresponding to the target application; the eighth device 202 provides the event description information to the corresponding user equipment that installs the target application; wherein the first device 203 acquires the user equipment. Returning application access data for the target application; wherein the second device 204 processes the application access data based on the event description information to determine event feature information about an application access event of the target application .
  • the seventh device 201 acquires event description information corresponding to the target application.
  • Each target application corresponds to event description information of one or more application access events, the event description information including a specific description of the corresponding application access event.
  • the same target application of different devices corresponds to event description information of the same set of application access events; different devices or similar applications on the same device may also correspond to event descriptions of the same set or different groups of application access events. information.
  • the event description information may be directly set in the network device 1 directly by an application developer according to actual needs of different applications.
  • the event description information may also be obtained from other possible third-party devices or databases, for example, based on a user's possible access operations for various types of applications, defining corresponding application access events, and setting corresponding events.
  • the information is described in advance, and the total application access time and the corresponding event description information are pre-stored in a third-party device, and different network devices 1 may directly be based on the type of the target application of the corresponding user equipment of the different network devices 1 Searching, in the third-party device, event description information that matches the target application, and if there is matching event description information, directly reading and using, and if there is no event description information that can be matched, performing corresponding event description information. customize.
  • the event description information customized for each network device 1 can be synchronized to the third-party device after the definition, so as to implement real-time update and expansion of the corresponding event description information in the third-party device.
  • the eighth device 202 provides the event description information to a corresponding user equipment that installs the target application.
  • the application access data of the target application acquired by the network device 1 may be an application that is indirectly selected to include the access related information corresponding to all access operations of the application into the network device 1.
  • the type of the corresponding application access data may be set in a targeted manner based on the characteristics of the different target applications; and, for example, the actual application scenario after the application access data processing may be determined in a targeted manner.
  • the type of application access data is performed in advance in the corresponding user equipment in which the target application is installed, thereby directly acquiring application access data that needs to be actually processed.
  • the operation of providing the event description information acquired by the network device 1 to the user equipment corresponding to the target application may be performed, so that the user equipment may perform corresponding targeted detection based on the event description information.
  • Sexual application access data collection For example, if the target application only needs to collect logins, visit page durations, and click controls. Applying the application access data corresponding to the access event, the user equipment may collect corresponding application access data according to the obtained event description information of each application access event, and other applications not defined in the event description information. The access event, in subsequent operations, the user equipment will not return it to the network device 1.
  • the user equipment may directly set an application triggering condition of the application access data of the target application based on the event description information, thereby collecting application access data required by the network device 1; the user equipment may also first The access-related information corresponding to all access operations is collected in an unselected manner, and then filtered based on the access-related information, thereby determining application access data that the network device 1 needs to acquire.
  • the first device 203 acquires application access data about the target application returned by the user equipment.
  • the user equipment will determine corresponding application access data.
  • the first device 203 further acquires the determined application access data from the user equipment.
  • the second device 204 of the network device 1 performs corresponding processing on the application access data of the target application returned from the user equipment, thereby determining a corresponding application. Access event event information for the event.
  • the application access data of the target application acquired by the first device 203 may be directly returned by the user equipment, or may be a three-party device that stores the application access data, such as synchronization corresponding to the user equipment. Equipment, or storage device, etc. sent.
  • the present application performs targeted screening on the application access data acquired from the user equipment by providing the event description information corresponding to the target application to the user equipment corresponding to the target application, so that the network device 1 is
  • the obtained application access data is the target data required for subsequent data processing, and is compared with the application access data acquired by the network device 1 compared with the access related information corresponding to all the access operations of the application by the user.
  • the workload of the application access data acquisition or collection is greatly simplified, and the accuracy and efficiency of the network device 1 in subsequent data processing are improved.
  • FIG. 3 illustrates a system diagram of a network device and user equipment for processing application access data in accordance with a preferred embodiment of the present application.
  • the network device 1 includes a seventh device 301, an eighth device 302, a first device 303, and a second device 304.
  • the user equipment 2 includes a ninth device 309, a tenth device 310, an eleventh device 311, and Twelfth device 312.
  • the seventh device 301 acquires event description information corresponding to the target application; the eighth device 302 provides the event description information to a corresponding user equipment that installs the target application; wherein the first device 303 acquires the user Application access data returned by the device with respect to the target application; wherein the second device 304 is based on The event description information processes the application access data to determine event characteristic information about an application access event of the target application.
  • the ninth device 309 acquires event description information about the target application on the user equipment provided by the corresponding network device; the tenth device 310 sets an acquisition trigger condition for the application access data of the target application based on the event description information; The eleven device 311 collects the application access data based on the acquisition trigger condition; the twelfth device 312 transmits the application access data to the network device.
  • the seventh device 301, the eighth device 302, the first device 303, and the second device 304 in FIG. 3 are the same as the seventh device 201, the eighth device 202, the first device 203, and the second in FIG.
  • the devices 204 are identical or substantially identical and will not be described again herein, and are incorporated herein by reference.
  • the ninth device 309 of the user equipment 2 acquires event description information about the target application on the user equipment 2 provided by the corresponding network device 1.
  • the event description information corresponds to the application access event, and the event description information includes a specific description of the application access event.
  • the event description information may include an event name of the application access event. , content description information of the application access event, application operation information corresponding to the access event, and the like.
  • the event description information of the target application may be directly obtained from the corresponding network device 1 or, in an actual application, may be obtained from any other possible server device.
  • the tenth device 310 of the user equipment 2 sets an acquisition trigger condition regarding application access data of the target application based on the event description information.
  • the application access data of the target application is obtained by collecting an application access log corresponding to the user access operation, and the collection trigger condition may be determined based on the event description information, for example, setting a user access corresponding to an application access event.
  • the setting is performed in advance in the target application corresponding to the user equipment 2 by means of a log burying point.
  • the event name and content description information of the application access event that needs to be collected may be manually buried in the form of a log (log) code, or automated when the business logic is complex.
  • log log
  • the eleventh device 311 collects the application access data based on the collection trigger condition.
  • the application access data is collected in a form of pulling the application access log.
  • the specific application access log corresponding to the event description information may be directly set based on the collection trigger condition; or may be read from the log file including all application access logs based on the collection trigger condition.
  • the event description information matches the corresponding part of the application access log.
  • the twelfth device 312 sends the application access data to the network device.
  • the application access data sent to the network device 1 is based on a target application in the user equipment 2
  • the collection of the event description information setting triggers information about the access operation of the filtered user.
  • the network device 1 Based on the application access data returned by the user device 2, the network device 1 processes the application access data based on the event description information to determine event feature information about an application access event of the target application.
  • the network device 1 of the system processes the application access data of the target application in the acquired user equipment based on the corresponding event description information to determine event feature information of the application access event of the target application.
  • the application access data for obtaining the event description can be obtained in a targeted manner, and statistically analyzed, thereby providing a favorable data foundation for subsequent information processing and application.
  • the user equipment 2 sets an acquisition triggering condition of the application access data in the target application in advance based on the event description information, so that the application access can be effectively obtained through a targeted burying point.
  • the data is such that the application access data acquired by the network device 1 is the target data required for subsequent data processing, and the access related information corresponding to all access operations of the user to the application is included in the application acquired by the network device 1.
  • Accessing data this preferred embodiment, enables the workload of application access data acquisition or collection to be greatly simplified, and improves the accuracy and efficiency of the network device 1 in subsequent data processing.
  • FIG. 4 shows a schematic diagram of a device of a network device 1 for a user to process application access data according to another preferred embodiment of the present application.
  • the network device 1 includes a first device 401, a second device 402, and a fourth device 403.
  • the first device 401 acquires application access data about a target application in the corresponding user equipment; the second device 402 processes the application access data based on the corresponding event description information to determine application access with respect to the target application. Event characteristic information of the event; the fourth device 403 identifies the visitor corresponding to the application access data based on the event feature information.
  • the first device 401 and the second device 402 in FIG. 4 are the same as or substantially the same as the first device 101 and the second device 102 in FIG. 1 , and therefore are not described herein again, and are included by reference. herein.
  • the fourth device 403 identifies the visitor corresponding to the application access data based on the event feature information.
  • the users corresponding to the respective target applications may be divided based on various dimensions.
  • the event feature information corresponding to the target application in the user equipment may directly reflect the behavior characteristics of the visitor corresponding to the event feature information. If the same application on different devices or the same application access event of the same application is comparable, the same application or the same application can access the difference of the event feature information corresponding to the event or the similarity analysis, and then the event feature The application access events corresponding to the information are differentiated and identified accordingly.
  • the application scenario is used to identify whether the visitor of the target application is a fake user or a real user.
  • the fake user of the target application may complete the user activation by means of a fake flash or an emulator.
  • the probability of similarity of the event feature information of the fake user is extremely high.
  • the average duration of the fake user accessing the device is extremely short, and most of the average time is less than 1 second, based on the average duration of the accessed device.
  • Corresponding event feature information may be used to identify the fake user to a certain extent. If, for a period of time, or for a plurality of periods, the target visitor has an average duration of the access device of the target application.
  • the visitor can be presumed to be a fake user.
  • a plurality of event feature information can be comprehensively considered as a condition for segmentation recognition.
  • different visitors of the same application may be different users who log in to the target application on different devices respectively, or may be different users who log in to the target application on the same device.
  • the application scenario is to identify whether the visitor of the target application is a fake user or a real user, for example, other existing or other possible application scenarios that may occur in the future. For example, based on other dimensions, such as visitor classification scenarios that are not limited to visitor purchasing power, hobbies, and the like, as applicable to the present invention, are also included in the scope of the present invention and are incorporated herein by reference. .
  • the present application can flexibly implement information classification and recognition in various specific application scenarios based on the event feature information of the acquired application access event and the corresponding algorithm.
  • the fourth device 403 identifies the visitor corresponding to the application access data by using a classification algorithm based on the event feature information.
  • the classification algorithm includes a machine learning classification algorithm, that is, based on the event feature information, the device corresponding to the application access data is classified and identified by means of machine learning training.
  • the machine learning classification algorithm includes performing corresponding model creation based on the event feature information, and completing segmentation recognition of the visitor based on the created model.
  • the machine learning classification algorithm identifies the visitor corresponding to the application access data.
  • the data labeling training can be performed by customizing the corresponding rule, thereby generating a model that can be used as a visitor identification standard.
  • the machine learning classification algorithm may include, but is not limited to, an algorithm such as a logistic regression algorithm and a random forest algorithm.
  • the recognition process of the visitor is as follows: It is assumed that a model M is generated after the training is completed, wherein the output result of M is labeled as two types of U and V, and the user corresponding to a target application is summarized. After the application access log of the device is processed for one day, the network device 1 processes the application access data corresponding to the application access log, and determines event feature information F of the application access event of the target application visitor, and the event is obtained. The feature information F is input to the model M, and based on the model M, it can be concluded that the event feature information F belongs to U or V.
  • the event probability information F may be calculated to belong to the respective probabilities of the respective categories, so that the event feature information F is determined to belong to U or V based on the magnitude of the membership probability P of the production.
  • the classification corresponding to the model is not limited to the two types, but may be arbitrarily increased or decreased based on the needs of the actual application scenario, and the corresponding classification may be transformed.
  • the discrete or continuous values may be corresponding to different identification divisions.
  • the continuous division is performed based on the numerical value of the membership probability, and the result is divided for each category.
  • the event feature information is preferably normalized, and the normalization process includes performing normalization processing within different dimensions respectively. That is, the same type of application access events are comparable, and the time feature information corresponding to the same type of application access event is normalized.
  • the fourth device identifies the visitor corresponding to the application access data by using a clustering algorithm based on the event feature information.
  • the clustering algorithm includes a machine learning clustering algorithm, that is, clustering and identifying a visitor corresponding to the application access data by using machine learning training based on the event feature information.
  • the machine learning clustering algorithm includes performing corresponding model creation based on the event feature information, and then completing segmentation recognition of the visitor based on the created model.
  • the machine clustering algorithm may also be preferred to identify the visitor corresponding to the application access data. In this case, no custom rules and standard training are required. Rather, it is based on the certain clustering criterion, for example, based on a certain distance algorithm, such as determining the Euclidean distance between the visitors. After running by the algorithm, the multi-class users are automatically classified according to the established distance. .
  • a model N is generated, wherein the number of clusters defining N is 2, such as setting clusters K and J, and corresponding to the centers NK and NJ of the classes K and J,
  • the data patterns of the NK and the NJ can be understood as embodies the standard features of the clustering category.
  • the network device 1 accesses the log based on the application.
  • Corresponding application access data is processed to determine event feature information E of the application access event of the target application visitor, and the event feature information E is input into the model N, and the model N can be separately calculated based on the model N.
  • the distance between the event feature information E and the two types of data centers NK and NJ is corresponding to the distance values LK and LJ, and the division of the corresponding visitors is determined based on the difference between the distance values LK and LJ corresponding to the E, for example, the distance.
  • the value LK is smaller than LJ, that is, the event feature information is closer to the feature represented by the class K, indicating that the probability that the visitor corresponding to the event feature information belongs to the K class is greater, and vice versa. Belongs to the J class is bigger.
  • the number of clusters corresponding to the model is not limited to the two types, but the corresponding clusters may be arbitrarily increased or decreased based on the needs of the actual application scenario.
  • the event feature information is preferably normalized, and the normalization process includes performing normalization processing in different dimensions respectively. That is, the same type of application access events are comparable, and the time feature information corresponding to the same type of application access event is normalized.
  • the network device 1 further comprises a fifth device (not shown), the fifth device determining the access based on a preset visitor credibility indicator and in combination with the recognition result corresponding to the visitor Credibility information.
  • the attribution of the event feature information may be determined based on the membership probability size corresponding to the event feature information.
  • the event feature information may be determined based on the difference between the event feature information and the distance value of each cluster center. Ownership.
  • the membership probability corresponding to the event feature information or the difference between the event feature information and the distance value of each cluster center can be customized based on actual needs. When the settings are different, the category attribute of the event feature information is directly affected.
  • the visitor of the application access event corresponding to the event feature information may determine that Real user, but if the membership probability is set to P2, it is possible to determine the same visitor as a fake user.
  • the visitor credibility indicator may be preset based on actual needs to perform the visitor corresponding to the application access data based on the machine learning classification algorithm.
  • the credibility indicator may include a grading index based on the membership probability, for example, setting a membership probability P corresponding to the real user, where 0 ⁇ P ⁇ 1, and may be set when 80% ⁇ P ⁇ 100% It is determined to be a real user; when 0 ⁇ P ⁇ 50%, it is determined to be a false user; when 50% ⁇ P ⁇ 80%, it can be tentatively determined to be a false user, waiting for further testing.
  • the credibility information of the questioner is a real user.
  • P is 60%
  • further analysis and judgment can be performed, for example, based on analysis of event feature information corresponding to other types of application access events.
  • the credibility indicator may include a grading index based on the membership probability as an example, and other existing or future forms of credibility indicators may be applicable to the present invention. It is also intended to be included within the scope of the invention and is hereby incorporated by reference.
  • the present application can determine the credibility information of the visitor, so as to more realistically reflect the authentic and credible information of the user in the application. Thereby better maintaining, improving and perfecting the application effect of the target application.
  • the network device 1 further comprises a sixth device (not shown), the sixth device performing access control on the target application based on the credibility information of the visitor.
  • a corresponding access control may be performed on the target application on the user equipment, for example, for a visitor who is determined not to be a real user, Send warnings, send authentication information, restrict access rights, block user accounts, and many other forms of access control.
  • the access control may also be different based on different credibility information, for example, for an access account determined to be a fake user, the account may be directly blocked; and for a visitor determined to be a suspected fake user Restricting the visitor by sending authentication information, restricting partial access rights, etc., and limiting the target application again based on further identification or in combination with the remedy of the visitor, or It is a follow-up operation such as deepening access control.
  • FIG. 5 is a schematic diagram of a method for processing application access data on a network device side according to still another aspect of the present application.
  • step S501 the network device 1 acquires application access data about a target application in the corresponding user equipment; in step S502, the network device 1 processes the application access data based on the corresponding event description information, Event feature information is determined for an application access event for the target application.
  • the network device 1 acquires application access data about a target application in the corresponding user equipment.
  • the user equipment includes, but is not limited to, various types of PCs, mobile phones, tablets, and other various terminal devices that can load corresponding target applications.
  • the target applications include, but are not limited to, application types corresponding to various terminal devices.
  • the target application corresponds to the user equipment, and the terminal device is a mobile terminal, such as a mobile phone, a tablet computer, etc., and the target application may be ipa, pxl, deb based on the Apple iOS system.
  • Applications such as formats can also be based on the Android apk format application, or can be based on the xap format of the Microsoft Windows Phone system, and so on.
  • the application access data includes access related information determined based on an access operation performed by the user in the target application of the terminal device.
  • the access operation includes a user clicking on a certain page of the application, clicking a certain control of the application, and the like, and based on the access operation, the access data includes page information of the user accessing the application, time of the user staying on the page, and user clicks.
  • the specific type of access data acquired by the network device 1 can be set based on actual needs.
  • the access related information corresponding to all access operations of the application by the user may be included in the application access data acquired by the network device 1 in an indiscriminate manner; for example, the characteristics of different target applications may also be targeted.
  • the type and content of the corresponding application access data are set. For example, the type and content of the application access data may be determined in a targeted manner based on the actual application scenario after the application access data processing.
  • the acquisition of the application access data may be periodically acquired, or other acquisition conditions may be set according to an actual application scenario.
  • the application access data may be directly obtained from a user equipment corresponding to the target application.
  • the application access data may be obtained by reading an application access log corresponding to the target application.
  • the application access data may also obtain the application access data from a third-party device corresponding to the target device, where the third-party device includes a device that can acquire and store the application access data.
  • a device such as a synchronization device corresponding to the user device, or a storage device.
  • step S502 the network device 1 processes the application access data based on the corresponding event description information to determine event feature information about an application access event of the target application.
  • the application access data acquired by the network device 1 includes access related information determined based on an access operation performed by the user in the target application of the terminal device.
  • the corresponding application access event is defined based on the user's access operation to the application. For example, if the user clicks the login key to log in to the application, the corresponding application access event can be defined as the login.
  • an access operation may correspond to one or more application access events. For example, when the user clicks into a page, the application access event may be corresponding to the login page information and the login page number.
  • the definition of the application access event may be set based on the running characteristics of the actual application or based on the needs of the actual application scenario after the application access data processing of the target application.
  • the event description information corresponds to the application access event
  • the event description information includes a specific description of the application access event.
  • the event description information may include the application access event.
  • the event name of the application access event may be any string that can uniquely determine the event;
  • the description content of the application access event may be any string, the purpose of which is to help distinguish the specific content of the event;
  • the processing information of the application access event may include operation information, and the purpose is to perform feature quantization on the application access event, for example, may be a quantity operation of an event content, a sum operation, an averaging operation, and the like.
  • the time name for defining the application access event is A1, and the description content of the application access event is login; the processing information of the application access event is a setting operator count, where the operator count corresponds to the login Number of calculations.
  • the event description information corresponding to the target application may be obtained by the network device 1 from any possible server device.
  • the event description information corresponding to the target application may also be determined by the application developer according to actual conditions. It is required to be directly set in the network device 1. Further, a corresponding plurality of application access events may be separately set for each target application, and corresponding event description information is set.
  • different target applications, or different kinds of target applications may correspond to different or the same application access events or event description information settings.
  • the processing, by the network device 1 for processing the application access data based on the event description information may include matching the obtained application access data with corresponding event description information, and if the matching is successful, based on the event description information.
  • the corresponding event feature information is determined by a calculation or statistical analysis method corresponding to the preset application access event.
  • the application access data may be processed differently based on the different forms of content of the application access data. For example, when the application access data is an application access log from the user device where the target application is located, if a row of logs is read, the string corresponding to the row log may be first decomposed based on a preset delimiter.
  • the application access data may be an undefined application access event, and no processing is ignored.
  • the network device 1 of the present application processes the application access data of the target application in the acquired user equipment based on the corresponding event description information to determine event feature information of the application access event of the target application.
  • the event feature information may reflect the relevant situation of the target application in the corresponding access operation in a user equipment, apply an event feature information analysis to a target, or comprehensively analyze a plurality of event feature information, which may provide subsequent information processing and application.
  • a favorable data base For example, if the same application on different devices or the same application access event of the same application is comparable, the same application or the same application can access the difference of the event feature information corresponding to the event or the similarity analysis, and then Application access information corresponding to event feature information The pieces are differentiated and identified accordingly.
  • the step S502 includes a sub-step S5021 (not shown) and a sub-step S5022 (not shown), wherein in sub-step S5021, the network device 1 accesses data to the application based on the event description information. Performing log analysis to obtain one or more application access events for the target application; in sub-step S5022, the network device 1 performs statistical processing on the one or more application access events to obtain corresponding event characteristics. information.
  • the network device 1 performs log analysis on the application access data based on the event description information to obtain one or more application access events related to the target application.
  • the application access data acquired by the network device 1 may have multiple forms of content, and different forms of application access data may correspond to different data processing.
  • the application access log corresponding to the application access data is obtained based on the log statistics service set by the user equipment corresponding to the target application, and the target is determined based on log analysis of the application access log. Apply the corresponding application access event.
  • the application access log itself corresponds to a non-transformed text file, but contains information that can be structured.
  • the log analysis includes: performing a line-by-line decomposition on the application access log, and then determining an application access event corresponding to the target application based on the result of the decomposition and combining the event description information.
  • the application access logs of different formats need to be corresponding to different log parsing rules, and the application access logs are parsed according to existing or customized log parsing rules.
  • the application access log obtained is read line by line.
  • each line of logs corresponds to an application access event. If there are multiple access operation information, it may be recorded in multiple logs.
  • the application access log is decomposed according to a predefined delimiter, and the decomposed character substrings may respectively correspond to corresponding application access events, or the contents of the plurality of character substrings may correspond to
  • An application access event is compared with the application access event defined in the event description information corresponding to the target application, so as to record an application access event that needs to be retained in the application access log.
  • the application access event corresponding to the character substring is compared with the application access event defined in the event description information corresponding to the target application, and may be performed based on the same or similar event description information.
  • the The application access event obtained by the network device 1 and the application access event corresponding to the application access event are matched according to the customized event name.
  • the event name of an application access event corresponds to a unique string B1.
  • the related information such as the event name in the application access log may be set in a predetermined format before the user equipment collects the application access data.
  • the user equipment collects a burying point based on event description information of the target application acquired from the network device 1, and further, when collecting application access data, each application access event in the corresponding application access log information is A unique event name is recorded for the corresponding record.
  • An application access event corresponding to the set target application in the application access data may be determined.
  • the network device 1 performs statistical processing on the one or more application access events to obtain corresponding event feature information.
  • the application access event may be calculated and statistically processed based on the event description information corresponding to the application access event.
  • the specific statistical processing method depends on the setting of the event description information.
  • the event feature information that is, the result of processing the application access event based on the event description information, preferably, the event feature information may further include a statistical result of processing results of several same application access events. .
  • the event description information includes qualitatively determining the application access event, determining, according to the qualitative judgment information, the nature of the application access event, and thereby using the event feature information of the application access event.
  • the event description information includes quantitative analysis of the application access event, for example, if the content of the application access event is not limited to a quantity operation, a sum operation, an averaging operation, or the like,
  • the application access event is feature-quantified based on the corresponding operation information, thereby determining the quantized result of each application access event as event feature information.
  • the event description information includes operator information of a corresponding event, wherein the second unit is based on the operator information corresponding to the application access event, One or more application access events are statistically processed to obtain corresponding event feature information.
  • the operator information includes operations that are not limited to a quantity operation, a summation operation, an averaging operation, and the like, and correspond to the operators count, sum, avg, and the like, respectively.
  • the target application exists on the device a1
  • the corresponding application access event C1 is determined, and the content description is the access page x, and the corresponding operator information is count, based on the event.
  • the event characteristic information of the corresponding event may be: an application access event C1:n, where n may be the number of times the user accesses the page x within a certain event.
  • the quantized event feature information may correspond to different quantization units.
  • the event feature information time dimension may be customized in the event description information, for example, by default, the log time may be included in the application access log, and a specific time is added in the log parsing process. Code logic to define time to meet actual needs.
  • the method for processing application access data on the network device side further includes step S503 (not shown), in the step S503, the network device 1 generates a corresponding icon based on the event feature information. Information and display the graphical information.
  • the graphic information includes, but is not limited to, various types of graphic description information such as a histogram, a pie chart, and the like.
  • a histogram can be used as an image for describing various feature sets.
  • the histogram corresponding to the event feature information may be directly input into the target recognition classifier for subsequent segmentation recognition.
  • the defined application access event may not be limited to a specific form, and any form-defined application access event may be displayed intuitively and conveniently through the graphical information.
  • a more intuitive visual comparison of the differences between event feature information can also be performed.
  • the multi-class users are automatically classified according to the established distance.
  • the event feature information corresponding to the visitor may be directly based on the The histogram distance between visitors is used to classify the visitors.
  • FIG. 6 shows a schematic diagram of a method for processing application access data on a network device side according to a preferred embodiment of the present application.
  • step S601 the network device 1 acquires event description information corresponding to the target application; in step S602, the network device 1 provides the event description information to a corresponding user equipment where the target application is installed; In step S603, the network device 1 acquires application access data about the target application returned by the user equipment; wherein, in step S604, the network device 1 searches the application based on the event description information.
  • the access data is processed to determine event characteristic information about an application access event for the target application.
  • the network device 1 acquires event description information corresponding to the target application.
  • Each target application corresponds to event description information of one or more application access events, the event description information including a specific description of the corresponding application access event.
  • the same target application of different devices corresponds to event description information of the same set of application access events; different devices or similar applications on the same device may also correspond to event descriptions of the same set or different groups of application access events. information.
  • the event description information may be directly set in the network device 1 directly by an application developer according to actual needs of different applications.
  • the event description information may also be obtained from other possible third-party devices or databases, for example, based on a user's possible access operations for various types of applications, defining corresponding application access events, and setting corresponding events.
  • the information is described in advance, and the total application access time and the corresponding event description information are pre-stored in a third-party device, and different network devices 1 may directly be based on the type of the target application of the corresponding user equipment of the different network devices 1 Searching, in the third-party device, event description information that matches the target application, and if there is matching event description information, directly reading and using, if there is no event description information that can be matched, then re-entering Customize the corresponding event description information.
  • the event description information customized for each network device 1 can be synchronized to the third-party device after the definition, so as to implement real-time update and expansion of the corresponding event description information in the third-party device.
  • step S602 the network device 1 provides the event description information to a corresponding user equipment that installs the target application.
  • the application access data of the target application acquired by the network device 1 may be an application that is indirectly selected to include the access related information corresponding to all access operations of the application into the network device 1.
  • the type of the corresponding application access data may be set in a targeted manner based on the characteristics of the different target applications; and, for example, the actual application scenario after the application access data processing may be determined in a targeted manner.
  • the type of application access data is performed in advance in the corresponding user equipment in which the target application is installed, thereby directly acquiring application access data that needs to be actually processed.
  • the operation of providing the event description information acquired by the network device 1 to the user equipment corresponding to the target application may be performed, so that the user equipment may perform corresponding targeted detection based on the event description information.
  • Sexual application access data collection For example, if the target application only needs to collect the application access data corresponding to the application access event, such as the login time, the access page duration, and the click control number, the user equipment may be targeted based on the acquired event description information of each application access event. The corresponding application access data is collected, and for other application access events that are not defined in the event description information, the user equipment does not return it to the network device 1 in subsequent operations.
  • the user equipment may directly set an application triggering condition of the application access data of the target application based on the event description information, thereby collecting application access data required by the network device 1; the user equipment may also first The access-related information corresponding to all access operations is collected in an unselected manner, and then filtered based on the access-related information, thereby determining application access data that the network device 1 needs to acquire.
  • the network device 1 acquires application access data about the target application returned by the user equipment.
  • the user equipment will determine corresponding application access data.
  • the network device 1 acquires the determined application access data from the user equipment.
  • step S604 based on the event description information corresponding to the target application, the network device 1 performs corresponding processing on the application access data of the target application returned from the user equipment, thereby determining a corresponding application. Access event event information for the event.
  • the application access data of the target application acquired by the network device 1 may be directly returned by the user equipment, or may be a three-party device that stores the application access data, such as a synchronization device corresponding to the user equipment. Or sent from a storage device.
  • the present application performs targeted screening on the application access data acquired from the user equipment by providing the event description information corresponding to the target application to the user equipment corresponding to the target application, so that the network device 1 is
  • the obtained application access data is the target data required for subsequent data processing, and is compared with the application access data acquired by the network device 1 compared with the access related information corresponding to all the access operations of the application by the user.
  • the workload of the application access data acquisition or collection is greatly simplified, and the accuracy and efficiency of the network device 1 in subsequent data processing are improved.
  • FIG. 7 shows a schematic diagram of a method for processing application access data in accordance with a preferred embodiment of the present application.
  • step S701 the network device 1 acquires event description information corresponding to the target application; in step S703, the network device 1 provides the event description information to a corresponding user equipment that installs the target application;
  • step S702 the user equipment 2 sets an acquisition trigger condition for the application access data of the target application based on the event description information.
  • step S704 the user equipment 2 collects the application based on the collection trigger condition. Accessing the data; in step S705, the network device 1 acquires application access data about the target application returned by the user equipment; in step S707, the network device 1 searches the application based on the event description information.
  • the access data is processed to determine event characteristic information about an application access event for the target application.
  • the steps S701, S703, S705, and S707 in FIG. 7 are the same or substantially the same as the steps S601, S602, S603, and S604 in FIG. 6, and therefore are not described herein again. This is incorporated by reference.
  • the user equipment 2 sets an acquisition trigger condition regarding application access data of the target application based on the event description information.
  • the event description information corresponds to the application access event, and the event description information includes a specific description of the application access event.
  • the event description information may include an event name of the application access event. , content description information of the application access event, application operation information corresponding to the access event, and the like.
  • the event description information of the target application may be directly obtained from the corresponding network device 1. In addition, in practical applications, it can also be obtained from any other possible server device.
  • the application access data of the target application is obtained by collecting an application access log corresponding to the user access operation, and the collection trigger condition may be determined based on the event description information, for example, setting a user access corresponding to an application access event.
  • the operation is performed, it is determined that the trigger condition is satisfied.
  • the setting is performed in advance in the target application corresponding to the user equipment 2 by means of a log burying point.
  • the event name and content description information of the application access event that needs to be collected may be manually buried in the form of a log (log) code, or automated when the business logic is complex.
  • the user implements the corresponding access operation it is determined that the collection trigger condition is satisfied.
  • step S704 the user equipment 2 collects the application access data based on the collection trigger condition.
  • the application access data is collected in a form of pulling the application access log.
  • the specific application access log corresponding to the event description information may be directly set based on the collection trigger condition; or may be read from the log file including all application access logs based on the collection trigger condition.
  • the event description information matches the corresponding part of the application access log.
  • the network device 1 of the system processes the application access data of the target application in the acquired user equipment based on the corresponding event description information to determine event feature information of the application access event of the target application.
  • the application access data for obtaining the event description can be obtained in a targeted manner, and statistically analyzed, thereby providing a favorable data foundation for subsequent information processing and application.
  • the user equipment 2 sets an acquisition triggering condition of the application access data in the target application in advance based on the event description information, so that the application access can be effectively obtained through a targeted burying point.
  • the data is such that the application access data acquired by the network device 1 is the target data required for subsequent data processing, and the access related information corresponding to all access operations of the user to the application is included in the application acquired by the network device 1.
  • Accessing data this preferred embodiment, enables the workload of application access data acquisition or collection to be greatly simplified, and improves the accuracy and efficiency of the network device 1 in subsequent data processing.
  • FIG. 8 is a schematic diagram of a method for processing application access data on a network device side according to another preferred embodiment of the present application.
  • step S801 the network device 1 acquires application access data about a target application in the corresponding user equipment; in step S802, the network device 1 processes the application access data based on the corresponding event description information, Determining event feature information about an application access event of the target application; in step S803, the network device 1 identifies a visitor corresponding to the application access data based on the event feature information.
  • the steps S801 and S802 in FIG. 8 are the same as or substantially the same as the steps S501 and S502 in FIG. 5, and thus are not described herein again, and are included herein by reference.
  • the network device 1 identifies the visitor corresponding to the application access data based on the event feature information.
  • the users corresponding to the respective target applications may be divided based on various dimensions.
  • the event feature information corresponding to the target application in the user equipment may directly reflect the behavior characteristics of the visitor corresponding to the event feature information. If the same application on different devices or the same application access event of the same application is comparable, the same application or the same application can access the difference of the event feature information corresponding to the event or the similarity analysis, and then the event feature The application access events corresponding to the information are differentiated and identified accordingly.
  • the application scenario is used to identify the target
  • the target user's visitor is a fake user or a real user
  • the fake user of the target application may complete the user activation by means of a fake flash or an emulator, etc.
  • there may be many statistical feature problems for example, In a specific dimension, the probability of similarity of the event feature information of the fake user is extremely high. For example, compared with the real user, the average duration of the fake user accessing the device is extremely short, and most of the average time is less than 1 second, based on the access device.
  • the event feature information corresponding to the average duration may be used to identify the fake user to a certain extent, and if so, the average duration of the target device's access device for the target application over a period of time or for a period of time
  • the feature information is substantially less than one second. If only the event feature information is set as the criterion for the true and false visitor identification, the visitor can be presumed to be a fake user. Further, based on the needs of the actual application scenario, a plurality of event feature information can be comprehensively considered as a condition for segmentation recognition. Here, different visitors of the same application may be different users who log in to the target application on different devices respectively, or may be different users who log in to the target application on the same device.
  • the application scenario is to identify whether the visitor of the target application is a fake user or a real user, for example, other existing or other possible application scenarios that may occur in the future. For example, based on other dimensions, such as visitor classification scenarios that are not limited to visitor purchasing power, hobbies, and the like, as applicable to the present invention, are also included in the scope of the present invention and are incorporated herein by reference. .
  • the present application can flexibly implement information classification and recognition in various specific application scenarios based on the event feature information of the acquired application access event and the corresponding algorithm.
  • the network device 1 identifies the visitor corresponding to the application access data by using a classification algorithm based on the event feature information.
  • the classification algorithm includes a machine learning classification algorithm, that is, based on the event feature information, the device corresponding to the application access data is classified and identified by means of machine learning training.
  • the machine learning classification algorithm includes performing corresponding model creation based on the event feature information, and completing segmentation recognition of the visitor based on the created model.
  • the machine learning classification algorithm identifies the visitor corresponding to the application access data.
  • the data labeling training can be performed by customizing the corresponding rule, thereby generating a model that can be used as a visitor identification standard.
  • the machine learning classification algorithm may include, but is not limited to, an algorithm such as a logistic regression algorithm and a random forest algorithm.
  • the recognition process of the visitor is as follows: It is assumed that a model M is generated after the training is completed, wherein the output result of M is labeled as two types of U and V, and the user corresponding to a target application is summarized. After the application access log of the device is processed for one day, the network device 1 processes the application access data corresponding to the application access log, and determines Entering the event feature information F into the model M to the model M of the application access event of the target application visitor, and based on the model M, the event feature information F belongs to the U or The conclusion of V.
  • the event probability information F may be calculated to belong to the respective probabilities of the respective categories, so that the event feature information F is determined to belong to U or V based on the magnitude of the membership probability P of the production.
  • the classification corresponding to the model is not limited to the two types, but may be arbitrarily increased or decreased based on the needs of the actual application scenario, and the corresponding classification may be transformed.
  • the discrete or continuous values may be corresponding to different identification divisions.
  • the continuous division is performed based on the numerical value of the membership probability, and the result is divided for each category.
  • the event feature information is preferably normalized, and the normalization process includes performing normalization processing within different dimensions respectively. That is, the same type of application access events are comparable, and the time feature information corresponding to the same type of application access event is normalized.
  • the network device 1 identifies the visitor corresponding to the application access data by using a clustering algorithm based on the event feature information.
  • the clustering algorithm includes a machine learning clustering algorithm, that is, clustering and identifying a visitor corresponding to the application access data by using machine learning training based on the event feature information.
  • the machine learning clustering algorithm includes performing corresponding model creation based on the event feature information, and then completing segmentation recognition of the visitor based on the created model.
  • the machine clustering algorithm may also be preferred to identify the visitor corresponding to the application access data. In this case, no custom rules and standard training are required. Rather, it is based on the certain clustering criterion, for example, based on a certain distance algorithm, such as determining the Euclidean distance between the visitors. After running by the algorithm, the multi-class users are automatically classified according to the established distance. .
  • a model N is generated, wherein the number of clusters defining N is 2, such as setting clusters K and J, and corresponding to the centers NK and NJ of the classes K and J,
  • the data patterns of the NK and the NJ can be understood as embodies the standard features of the clustering category.
  • the network device 1 accesses the log based on the application.
  • Corresponding application access data is processed to determine event feature information E of the application access event of the target application visitor, and the event feature information E is input into the model N, and the model N can be separately calculated based on the model N.
  • the distance between the event feature information E and the two types of data centers NK and NJ is corresponding to the distance values LK and LJ, and the division of the corresponding visitors is determined based on the difference between the distance values LK and LJ corresponding to the E, for example, the distance.
  • the value LK is smaller than the LJ, that is, the event feature information is closer to the feature represented by the class K, indicating that the visitor corresponding to the event feature information belongs to the K class.
  • the probability is greater, and vice versa is greater for the J class.
  • the number of clusters corresponding to the model is not limited to the two types, but the corresponding clusters may be arbitrarily increased or decreased based on the needs of the actual application scenario.
  • the event feature information is preferably normalized, and the normalization process includes performing normalization processing in different dimensions respectively. That is, the same type of application access events are comparable, and the time feature information corresponding to the same type of application access event is normalized.
  • the method for processing application access data on the network device side further includes step S804 (not shown), and in step S804, the network device 1 is based on a preset visitor credibility indicator and combined The recognition result corresponding to the visitor determines the credibility information of the visitor.
  • the attribution of the event feature information may be determined based on the membership probability size corresponding to the event feature information.
  • the event feature information may be determined based on the difference between the event feature information and the distance value of each cluster center. Ownership.
  • the membership probability corresponding to the event feature information or the difference between the event feature information and the distance value of each cluster center can be customized based on actual needs. When the settings are different, the category attribute of the event feature information is directly affected.
  • the visitor of the application access event corresponding to the event feature information may determine that Real user, but if the membership probability is set to P2, it is possible to determine the same visitor as a fake user.
  • the visitor credibility indicator may be preset based on actual needs to perform the visitor corresponding to the application access data based on the machine learning classification algorithm.
  • the credibility indicator may include a grading index based on the membership probability, for example, setting a membership probability P corresponding to the real user, where 0 ⁇ P ⁇ 1, and may be set when 80% ⁇ P ⁇ 100% It is determined to be a real user; when 0 ⁇ P ⁇ 50%, it is determined to be a false user; when 50% ⁇ P ⁇ 80%, it can be tentatively determined to be a false user, waiting for further testing.
  • the credibility information of the questioner is a real user.
  • P is 60%
  • further analysis and judgment can be performed, for example, based on analysis of event feature information corresponding to other types of application access events.
  • the credibility indicator may include a grading index based on the membership probability as an example, and other existing or future forms of credibility indicators may be applicable to the present invention. ,and also It is intended to be included within the scope of the invention and is hereby incorporated by reference.
  • the present application can determine the credibility information of the visitor, so as to more realistically reflect the authentic and credible information of the user in the application. Thereby better maintaining, improving and perfecting the application effect of the target application.
  • the method for processing application access data on the network device side further includes step S805 (not shown), in step S805, the network device 1 is based on the credibility information of the visitor.
  • the target application performs access control.
  • a corresponding access control may be performed on the target application on the user equipment, for example, for a visitor who is determined not to be a real user, Send warnings, send authentication information, restrict access rights, block user accounts, and many other forms of access control.
  • the access control may also be different based on different credibility information, for example, for an access account determined to be a fake user, the account may be directly blocked; and for a visitor determined to be a suspected fake user Restricting the visitor by sending authentication information, restricting partial access rights, etc., and limiting the target application again based on further identification or in combination with the remedy of the visitor, or It is a follow-up operation such as deepening access control.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Databases & Information Systems (AREA)
  • Data Mining & Analysis (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Information Transfer Between Computers (AREA)
  • Telephonic Communication Services (AREA)

Abstract

一种用于处理应用访问数据的方法与设备，所述方法包括：获取关于对应用户设备中目标应用的应用访问数据（S501）；基于对应的事件描述信息对所述应用访问数据进行处理，以确定关于所述目标应用的应用访问事件的事件特征信息（S502）。网络设备通过基于对应的事件描述信息，对所获取的用户设备中目标应用的应用访问数据进行处理，以确定所述目标应用的应用访问事件的事件特征信息，在此，基于所述自定义的事件描述信息，可以有针对性地对获取符合事件描述的应用访问数据，并对其进行统计分析，从而为后续的信息处理和应用提供有利的数据基础。

Description

一种用于处理应用访问数据的方法与设备
本申请要求2015年05月22日递交的申请号为201510266206.3、发明名称为“一种用于处理应用访问数据的方法与设备”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及计算机领域，尤其涉及一种用于处理应用访问数据的技术。
背景技术
在互联网场景下，很多时候希望基于一定的目的对目标用户进行准确的类别划分，例如，基于各种维度，对网站的访问者进行相应的划分，所述维度可以包括用户偏好、用户身份等各种信息，进而，可以基于划分结果进行后续的相应处理和分析应用，如为目标用户提供有区别的服务等。例如，基于用户浏览网页行为对应的信息来识别网站的真实用户和虚假用户。但是现有的用户识别方案主要是依赖于用户浏览器信息，如基于用户浏览器的cookie信息等对用户进行分类，而对于移动应用对应的用户识别，如移动应用的真假用户的识别，由于没有可依赖的用户浏览器行为，所以并没有相应的有效识别方法。
发明内容
本申请的目的是提供一种用于处理应用访问数据的方法与设备。
根据本申请的一个方面，提供了一种在网络设备端用于处理应用访问数据的方法，其中，所述方法包括：
获取关于对应用户设备中目标应用的应用访问数据；
基于对应的事件描述信息对所述应用访问数据进行处理，以确定关于所述目标应用的应用访问事件的事件特征信息。
根据本申请的另一方面，还提供了一种在用户设备端用于处理应用访问数据的方法，其中，所述方法包括：
获取对应网络设备提供的关于用户设备上的目标应用的事件描述信息；
基于所述事件描述信息设置关于所述目标应用的应用访问数据的采集触发条件；
基于所述采集触发条件采集所述应用访问数据；
将所述应用访问数据发送至所述网络设备。
根据本申请的再一方面，还提供了一种用于处理应用访问数据的网络设备，其中，所述网络设备包括：
第一装置，用于获取关于对应用户设备中目标应用的应用访问数据；
第二装置，用于基于对应的事件描述信息对所述应用访问数据进行处理，以确定关于所述目标应用的应用访问事件的事件特征信息。
根据本申请的又一方面，还提供了一种用于处理应用访问数据的用户设备，其中，所述用户设备包括：
第九装置，用于获取对应网络设备提供的关于用户设备上的目标应用的事件描述信息；
第十装置，用于基于所述事件描述信息设置关于所述目标应用的应用访问数据的采集触发条件；
第十一装置，用于基于所述采集触发条件采集所述应用访问数据；
第十二装置，用于将所述应用访问数据发送至所述网络设备。
根据本申请的另一方面，还提供了一种用于处理应用访问数据的***，其中，所述***包括：根据本申请的再一方面提供的一种用于处理应用访问数据的网络设备，以及据本申请的再一方面提供的一种用于处理应用访问数据的用户设备。
与现有技术相比，本申请的网络设备通过基于对应的事件描述信息，对所获取的用户设备中目标应用的应用访问数据进行处理，以确定所述目标应用的应用访问事件的事件特征信息，在此，基于所述自定义的事件描述信息，可以有针对性地对获取符合事件描述的应用访问数据，并对其进行统计分析，从而为后续的信息处理和应用提供有利的数据基础。进一步，基于所获取的应用访问事件的事件特征信息，结合相应的算法，可以灵活地实现各类具体应用场景下的信息分类识别。进一步，基于应用访问者的识别结果，并结合预置的访问者可信度指标，可以确定访问者的可信度信息，从而能够更实际地反映应用内用户的真实可信信息，从而更好的维护、改进和完善目标应用的应用效果。进一步，本申请基于所述事件特征信息生成对应的图示信息，从而借助图示信息，能够对所述事件特征信息进行更形象直观地描述。进一步，在本申请中，所述用户设备基于所述事件描述信息，预先在目标应用中设置应用访问数据的采集触发条件，从而可以通过有针对性的埋点，有效地获取应用访问数据，进而为后续的数据统计分析提供有利的数据基础。
附图说明
通过阅读参照以下附图所作的对非限制性实施例所作的详细描述，本发明的其它特征、目的和优点将会变得更明显：
图1示出根据本申请一个方面的一种用于处理应用访问数据的网络设备的设备示意图；
图2示出根据本申请一个优选实施例的一种于处理应用访问数据的网络设备的设备示意图；
图3示出根据本申请一个优选实施例的一种用于处理应用访问数据的网络设备和用户设备的***示意图；
图4示出根据本申请另一个优选实施例的一种用户处理应用访问数据的网络设备的设备示意图；
图5示出根据本申请再一个方面的一种在网络设备端用于处理应用访问数据的方法示意图；
图6示出根据本申请一个优选实施例的一种在网络设备端用于处理应用访问数据的方法示意图；
图7示出根据本申请一个优选实施例的一种用于处理应用访问数据的方法示意图；
图8示出根据本申请另一个优选实施例的一种在网络设备端用于处理应用访问数据的方法示意图。
附图中相同或相似的附图标记代表相同或相似的部件。
具体实施方式
下面结合附图对本发明作进一步详细描述。
在本申请一个典型的配置中，终端、服务网络的设备和可信方均包括一个或多个处理器(CPU)、输入/输出接口、网络接口和内存。
内存可能包括计算机可读介质中的非永久性存储器，随机存取存储器(RAM)和/或非易失性内存等形式，如只读存储器(ROM)或闪存(flash RAM)。内存是计算机可读介质的示例。
计算机可读介质包括永久性和非永久性、可移动和非可移动媒体可以由任何方法或技术来实现信息存储。信息可以是计算机可读指令、数据结构、程序的模块或其他数据。计算机的存储介质的例子包括，但不限于相变内存(PRAM)、静态随机存取存储器 (SRAM)、动态随机存取存储器(DRAM)、其他类型的随机存取存储器(RAM)、只读存储器(ROM)、电可擦除可编程只读存储器(EEPROM)、快闪记忆体或其他内存技术、只读光盘只读存储器(CD-ROM)、数字多功能光盘(DVD)或其他光学存储、磁盒式磁带，磁带磁盘存储或其他磁性存储设备或任何其他非传输介质，可用于存储可以被计算设备访问的信息。按照本文中的界定，计算机可读介质不包括非暂存电脑可读媒体(transitory media)，如调制的数据信号和载波。
图1示出根据本申请一个方面的一种用于处理应用访问数据的网络设备1的设备示意图。其中，所述网络设备1包括第一装置101和第二装置102。
其中，第一装置101获取关于对应用户设备中目标应用的应用访问数据；第二装置102基于对应的事件描述信息对所述应用访问数据进行处理，以确定关于所述目标应用的应用访问事件的事件特征信息。
具体地，所述网络设备1的第一装置101获取关于对应用户设备中目标应用的应用访问数据。在此，所述用户设备包括但不限于各种类型的PC、移动电话、平板电脑、以及其他各种可以装载对应目标应用的终端设备。所述目标应用包括但不限于与各种终端设备相对应的应用类型。在此，所述目标应用与所述用户设备相对应，以所述终端设备是移动终端，如移动电话、平板电脑等为例，所述目标应用可以是基于苹果iOS***的ipa，pxl，deb等格式的应用，也可以是基于安卓***的apk格式的应用，还可以是基于微软windowsphone***的xap格式的应用，等等。在此，所述应用访问数据包括基于用户在所述终端设备的所述目标应用中进行的访问操作所确定的访问相关信息。例如，所述访问操作包括用户点击进入应用的某一页面、用户点击应用的某一控件等，基于所述访问操作，所述访问数据包括用户访问应用的页面信息、用户在该页面停留的时间、用户点击应用中相应控件的次数、用户在一定时间内访问所述应用消耗的流量信息，等等。在此，所述网络设备1获取的访问数据的具体种类可以基于实际需要进行设置。例如，可以不加选择的将用户对应用的全部访问操作对应的访问相关信息都纳入进所述网络设备1获取的应用访问数据中；又如，还可以基于不同目标应用的特点有针对性的设置对应的应用访问数据的种类和内容；再如，还可以基于应用访问数据处理后的实际应用场景有针对性地确定所述应用访问数据的种类和内容。
在此，所述应用访问数据的获取可以是周期性获取，或是根据实际应用场景设定其他的获取条件。此外，所述应用访问数据可以直接从所述目标应用对应的用户设备中获取。例如，可以通过读取目标应用对应的应用访问日志来获取所述应用访问数据。此外， 所述应用访问数据还可以从与所述目标应用所述在用户设备相对应的第三方设备中获取所述应用访问数据，所述第三方设备包括能够获取、存储所述应用访问数据的设备，如所述用户设备对应的同步设备、或是存储设备等。
接着，第二装置102基于对应的事件描述信息对所述应用访问数据进行处理，以确定关于所述目标应用的应用访问事件的事件特征信息。
具体地，所述网络设备1获取的所述应用访问数据包括基于用户在所述终端设备的所述目标应用中进行的访问操作所确定的访问相关信息。在此，基于用户对应用的访问操作定义了相应的应用访问事件，例如，用户点击登录键登录应用，则可以定义相应的应用访问事件为登录。在此，一个访问操作可能对应一个或多个应用访问事件，例如，用户点击进入一个页面，可以同时对应登录页面信息和登录页面次数两个应用访问事件。应用访问事件的定义可以基于实际应用的运行特征、或是基于对该目标应用的应用访问数据处理后的实际应用场景的需要进行设置。在此，所述事件描述信息与所述应用访问事件对应，所述事件描述信息包含对所述应用访问事件的具体描述，在此，优选地，所述事件描述信息可以包括所述应用访问事件的事件名称，对应用访问事件的内容描述信息，应用访问事件对应的处理信息，等等。例如，所述应用访问事件的事件名称可以为任意能够唯一确定该事件的字符串；又如，所述应用访问事件的描述内容可以为任意字符串，其目的是帮助分辨事件的具体内容；再如，所述应用访问事件的处理信息可以包括运算信息，目的是对所述应用访问事件进行特征量化，如，可以是事件内容的数量运算、求和运算、求平均值运算等等。以所述用户点击登录键登录应用这一操作为例，可以定义所述应用访问事件的时间名称为A1，所述应用访问事件的描述内容为登录；所述应用访问事件的处理信息为设置算子count，在此，所述算子count即对应于登录次数计算。
其中，所述目标应用对应的事件描述信息可以由所述网络设备1从任意可能的服务器设备中获取，在此，优选地，所述目标应用对应的事件描述信息还可以由应用开发者根据实际需要直接在所述网络设备1中设置，进一步，可以针对每一个目标应用分别设置对应的若干个应用访问事件，并设置对应的事件描述信息。在此，不同目标应用，或是不同种类的目标应用可以对应不同、或是相同的应用访问事件、或是事件描述信息的设置。
在此，所述网络设备1的第二装置102基于所述事件描述信息对所述应用访问数据进行处理可以包括将所获得的应用访问数据与相应的事件描述信息进行匹配，若是匹配 成功，则基于事件描述信息中预先设置的应用访问事件对应的计算或是统计分析方式确定相应的事件特征信息。可以基于所述应用访问数据的不同形式内容，对所述应用访问数据做不同的处理。例如，当所述应用访问数据为来自所述目标应用所在用户设备的应用访问日志时，假设读取了一行日志，则可以先基于预设的分隔符对该行日志对应的字符串进行分解，获得相应字符子串，再基于所述字符子串，与该目标应用对应的所述事件描述信息进行匹配。如果所述匹配成功，则基于所述事件描述信息中对应的具体描述信息，如所述应用访问事件的运算信息，对所述应用访问数据进行相应计算或统计，从而确定所获得的该应用访问数据对应的目标应用的应用访问事件的事件特征信息，并进一步，对所述事件特征信息进行特定的归类统计，如，设置以用户设备为主键的数据库，并将所述事件特征信息存入该数据库，进一步，基于后续所述时间特征信息的确定更新所述数据库信息。如果所述匹配不成功，则所述应用访问数据对应的可能是未定义的应用访问事件，则忽略不做处理。
在此，本申请的网络设备1通过基于对应的事件描述信息，对所获取的用户设备中目标应用的应用访问数据进行处理，以确定所述目标应用的应用访问事件的事件特征信息。事件特征信息可以反映一个用户设备中目标应用在相应访问操作中的相关情况，对一个目标应用一个事件特征信息分析、或是若干个事件特征信息的综合分析，可以为后续的信息处理和应用提供有利的数据基础。例如，若是不同设备上的同一应用、或是同类应用的相同应用访问事件具有可比性，则可以通过同一应用、或同类应用访问事件对应的事件特征信息的差异或是相似程度的分析，进而对事件特征信息对应的应用访问事件进行相应的区分、识别。
优选地，所述网络设备1的第二装置包括第一单元(未示出)和第二单元(未示出)，其中，所述第一单元基于所述事件描述信息对所述应用访问数据进行日志分析，以获得关于所述目标应用的一个或多个应用访问事件；第二单元对所述一个或多个应用访问事件进行统计处理以获得对应的事件特征信息。
具体地，所述第一单元基于所述事件描述信息对所述应用访问数据进行日志分析，以获得关于所述目标应用的一个或多个应用访问事件。在此，本申请中，所述网络设备1获取的应用访问数据可以有多种形式内容，不同形式的应用访问数据会对应不同的数据处理。在此，优选地，基于所述目标应用所对应的用户设备设置的日志统计服务，获取所述应用访问数据对应的应用访问日志，进而基于对所述应用访问日志进行日志分析来确定所述目标应用对应的应用访问事件。应用访问日志本身对应的是非结果化的文本 文件，但其中包含着可以结构化出来的信息。所述日志分析包括：首先对所述应用访问日志进行逐行分解，然后基于该分解的结果，并结合所述事件描述信息，确定所述目标应用对应的应用访问事件。具体地，不同格式的应用访问日志需要对应于不同的日志解析规则，基于已有或是自定义的日志解析规则对所述应用访问日志进行相应解析。例如，逐行读取获得的应用访问日志，优选地，每一行日志对应于一个应用访问事件，若是有多个访问操作信息，可以以多条日志的形式分别记录。进而，按照预先定义好的分隔符对所述应用访问日志进行字符串分解，分解后的各个字符子串可能分别对应于相应的的应用访问事件，也可能若干个字符子串的内容共同对应于一个应用访问事件，再将该应用访问事件与所述目标应用对应的事件描述信息中定义的应用访问事件进行对照，从而记录下该应用访问日志中需要留用的应用访问事件。所述字符子串对应的应用访问事件与所述目标应用对应的事件描述信息中定义的应用访问事件进行对照，可以是基于相同或相似的事件描述信息而进行，在此，优选地，所述网络设备1获取的应用访问日志与应用访问事件对应的事件描述信息中定义的应用访问事件，基于自定义的事件名称进行匹配，例如，某应用访问事件的事件名称对应于唯一的字符串B1。所述应用访问日志中事件名称等相关信息可以是在用户设备采集应用访问数据之前就设置在预定格式中的。例如，所述用户设备基于从所述网络设备1获取的所述目标应用的事件描述信息进行采集埋点，进而，在采集应用访问数据时，对应的应用访问日志信息中每一个应用访问事件都对应记录一个唯一的事件名称。从而，基于所述事件名称信息，可以确定所述应用访问数据中有哪些目标应用对应设置的应用访问事件。
接着，所述第二单元对所述一个或多个应用访问事件进行统计处理以获得对应的事件特征信息。
具体地，当基于所述目标应用的应用访问数据确定了若干个应用访问事件后，基于该应用访问事件对应的事件描述信息，可以对所述应用访问事件进行计算、统计处理。具体统计处理方法取决于所述事件描述信息的设置。所述事件特征信息，即对应于基于所述事件描述信息对所述应用访问事件进行处理的结果，优选地，所述事件特征信息还可以包括对若干个同一应用访问事件的处理结果的统计结果。例如，若是所述事件描述信息包括对所述应用访问事件进行定性判断，则基于所述定性判断的信息，确定该应用访问事件的性质，进而以此作为该应用访问事件的事件特征信息。又如，若是所述事件描述信息包括对所述应用访问事件进行定量分析，如，对所述应用访问事件的内容进行不限于数量运算、求和运算、求平均值运算等类别的运算，则基于相应的运算信息对所 述应用访问事件进行特征量化，从而将各个应用访问事件的量化结果确定为事件特征信息。
更优选地，所述事件描述信息包括对应事件的运算符信息，其中，其中，所述第二单元基于所述应用访问事件所对应的所述运算符信息，对所述一个或多个应用访问事件进行统计处理以获得对应的事件特征信息。
具体地，所述运算符信息包括不限于数量运算、求和运算、求平均值运算等类别的运算，如，分别对应于算子count、sum、avg等。例如，假设目标应用存在于设备a1上，基于该设备a1上目标应用的事件描述信息，确定对应一个应用访问事件C1，内容描述为访问页面x，对应的运算符信息为count，则基于该事件描述信息，对获取的应用访问日志进行解析后，得到的该对应事件的事件特征信息可能是：应用访问事件C1：n，在此，n可以为一定事件内用户访问页面x的次数。在此，对于量化的所述事件特征信息，不同应用访问事件可以对应不同的量化单位。此外，具体应用中，还可以在事件描述信息中自定义所述事件特征信息时间维度，例如默认按天统计，可以在应用访问日志中包含日志时间，并在所述日志解析过程中加入特定的代码逻辑来定义时间，以满足实际需要。
优选地，所述网络设备1还包括第三装置(未示出)，所述第三装置用于基于所述事件特征信息生成对应的图示信息，并显示所述图示信息。
具体地，在此，所述图示信息包括但不限于直方图、饼图等各种类型的图形描述信息。以所述直方图为例，在通用算法领域，直方图可以用作为对各类特征集合进行形象的描述。在此，可以直接将对应于所述事件特征信息的直方图输入到目标识别分类器中，进行后续的划分识别。在此，所定义的应用访问事件可以不局限于具体形态，任意形式定义的应用访问事件都可以很直观、并且很方便的通过所述图示信息显示出来。此外，基于所述图示信息、例如所述直方图的图形结构，对事件特征信息之间的差异性也可以进行更加直观形象的对比分析。例如，在后续通过所述机器聚类算法来对应用访问数据对应的访问者进行识别过程中，可以基于所述一定的聚类准则，例如，基于一定的距离算法，如确定所述访问者之间的欧式距离，通过所述算法运行后，会自动将多类用户按照既定的距离进行分类，此时，若是所述访问者对应的事件特征信息有相应的直方图信息，则可以直接基于所述访问者之间的直方图距离来对所述访问者进行分类。
图2示出根据本申请一个优选实施例的一种于处理应用访问数据的网络设备1的设备示意图。其中，所述网络设备1包括第七装置201、第八装置202、第一装置203和第 二装置204。
其中，第七装置201获取目标应用对应的事件描述信息；第八装置202将所述事件描述信息提供至安装所述目标应用的对应用户设备；其中，所述第一装置203获取所述用户设备返回的关于所述目标应用的应用访问数据；其中，所述第二装置204基于所述事件描述信息对所述应用访问数据进行处理，以确定关于所述目标应用的应用访问事件的事件特征信息。
具体地，在此，所述第七装置201获取目标应用对应的事件描述信息。每一个目标应用对应于一个或多个应用访问事件的事件描述信息，所述事件描述信息包含对对应所述应用访问事件的具体描述。优选地，不同设备的同一目标应用对应于相同的一组应用访问事件的事件描述信息；不同设备或是同一设备上的相似应用也可以对应于相同一组或不同组的应用访问事件的事件描述信息。在此，优选地，所述事件描述信息可以直接由应用开发者根据各个不同应用的实际需要直接在所述网络设备1中设置。此外，进一步，所述事件描述信息还可以从其他可能的第三方设备或是数据库中获取，例如，基于用户对各种类型应用可能的访问操作，定义相应的应用访问事件，并设置对应的事件描述信息，并将该全部的应用访问时间和对应的事件描述信息预先存储在一个第三方设备中，基于不同的网络设备1各自对应的用户设备的目标应用的类型，不同的网络设备1可以直接在所述第三方设备中寻找与所述目标应用匹配的事件描述信息，若是有相匹配的事件描述信息则直接读取使用，若是没有可匹配的事件描述信息，则再进行相应事件描述信息的自定义。对于各个网络设备1自定义的事件描述信息，可以在定义后同步到所述第三方设备中，从而实现第三方设备中相应事件描述信息的实时更新、扩充。
接着，第八装置202将所述事件描述信息提供至安装所述目标应用的对应用户设备。
在本申请中，所述网络设备1获取的所述目标应用的应用访问数据可以是不加选择的将用户对应用的全部访问操作对应的访问相关信息都纳入进所述网络设备1获取的应用访问数据中；又如，还可以基于不同目标应用的特点有针对性的设置对应的应用访问数据的种类；再如，还可以基于应用访问数据处理后的实际应用场景有针对性地确定所述应用访问数据的种类。在此，优选地，在安装所述目标应用的对应用户设备中预先进行设置，从而直接获取需要实际需要进行后续处理的应用访问数据。在此，即可以通过将所述网络设备1获取的事件描述信息提供至所述目标应用对应的用户设备这一操作，从而使得，所述用户设备可以基于所述事件描述信息进行相应的有针对性的应用访问数据的采集。例如，若是目标应用只需要采集登陆、访问页面时长、点击控件次数这几个 应用访问事件对应的应用访问数据，则所述用户设备基于获取的上述各个应用访问事件的事件描述信息即可以针对性的采集相应的应用访问数据，而对于该事件描述信息中没有定义的其他应用访问事件，在后续操作中，所述用户设备则不会在将其返回给网络设备1。在此，所述用户设备可以基于所述事件描述信息直接设置所述目标应用的应用访问数据的采集触发条件，从而采集到所述网络设备1需要的应用访问数据；所述用户设备还可以先不加选择的采集全部访问操作对应的访问相关信息，再基于所述访问相关信息进行筛选，从而确定所述网络设备1需要获取的应用访问数据。
接着，所述第一装置203获取所述用户设备返回的关于所述目标应用的应用访问数据。在此，优选地，基于所述网络设备1提供至所述目标应用对应的用户设备的事件描述信息，所述用户设备将确定相对应的应用访问数据。进而所述第一装置203从所述用户设备获取确定的该应用访问数据。接着，再次基于所述目标应用对应的事件描述信息，所述网络设备1的第二装置204对从所述用户设备返回的所述目标应用的应用访问数据，进行相应的处理，进而确定对应应用访问事件的事件特征信息。在此，所述第一装置203获取的目标应用的应用访问数据可以是直接由所述用户设备返回的，也可能由存储了所述应用访问数据的三方设备，如所述用户设备对应的同步设备、或是存储设备等发送来的。
在此，本申请通过将所述目标应用对应的事件描述信息预先提供至所述目标应用对应的用户设备，从而对从用户设备获取的应用访问数据进行了针对性筛选，使得所述网络设备1获取的应用访问数据即为后续数据处理需要的目标数据，相比与将用户对应用的全部访问操作对应的访问相关信息都纳入进所述网络设备1获取的应用访问数据，此优选操作，能够使得应用访问数据获取或采集的工作量大大简化，并提高了所述网络设备1在后续数据处理中的准确性和效率。
图3示出根据本申请一个优选实施例的一种用于处理应用访问数据的网络设备和用户设备的***示意图。
其中，所述网络设备1包括第七装置301、第八装置302、第一装置303和第二装置304；所述用户设备2包括第九装置309、第十装置310、第十一装置311和第十二装置312。
具体地，第七装置301获取目标应用对应的事件描述信息；第八装置302将所述事件描述信息提供至安装所述目标应用的对应用户设备；其中，所述第一装置303获取所述用户设备返回的关于所述目标应用的应用访问数据；其中，所述第二装置304基于所 述事件描述信息对所述应用访问数据进行处理，以确定关于所述目标应用的应用访问事件的事件特征信息。所述第九装置309获取对应网络设备提供的关于用户设备上的目标应用的事件描述信息；第十装置310基于所述事件描述信息设置关于所述目标应用的应用访问数据的采集触发条件；第十一装置311基于所述采集触发条件采集所述应用访问数据；第十二装置312将所述应用访问数据发送至所述网络设备。在此，图3中所述第七装置301、第八装置302、第一装置303和第二装置304与图2中所述第七装置201、第八装置202、第一装置203和第二装置204对应相同或基本相同，故此处不再赘述，并通过引用的方式包含于此。
具体地，所述用户设备2的第九装置309获取对应网络设备1提供的关于用户设备2上的目标应用的事件描述信息。所述事件描述信息与所述应用访问事件对应，所述事件描述信息包含对所述应用访问事件的具体描述，在此，优选地，所述事件描述信息可以包括所述应用访问事件的事件名称，对应用访问事件的内容描述信息，应用访问事件对应的运算信息，等等。在此，优选地，所述目标应用的事件描述信息可以直接从对应的网络设备1中获取，或者，在实际应用中，也可以从其他任意可能的服务器设备中获取。
接着，所述用户设备2的第十装置310基于所述事件描述信息设置关于所述目标应用的应用访问数据的采集触发条件。在此，优选地，通过采集用户访问操作对应的应用访问日志来获取目标应用的应用访问数据，所述采集触发条件可以基于事件描述信息确定，例如，设置当出现某应用访问事件对应的用户访问操作时，即确定为触发条件满足。进而通过日志埋点的方式预先在所述用户设备2对应的目标应用中进行设置。例如，可以将需要采集的应用访问事件的事件名称、内容描述信息借助log(日志)代码的形式进行手动埋点、或是在业务逻辑复杂时，进行自动化埋点。当用户实施了相应的访问操作，则确定满足所述采集触发条件。
接着，所述第十一装置311基于所述采集触发条件采集所述应用访问数据。在此，优选地，以拉取所述应用访问日志的形式采集所述应用访问数据。可以是基于所述采集触发条件，直接设置与所述事件描述信息对应的专门的应用访问日志；也可以基于所述采集触发条件，从包含了全部应用访问日志的日志文件中读取与所述事件描述信息匹配的相应部分的应用访问日志。
接着，所述第十二装置312将所述应用访问数据发送至所述网络设备。在此，优选地，发送至所述网络设备1中的所述应用访问数据是基于所述用户设备2中目标应用的 事件描述信息设置的采集触发条件筛选过的用户的访问操作的相关信息。基于所述用户设备2返回的该应用访问数据，所述网络设备1将基于所述事件描述信息对所述应用访问数据进行处理，以确定关于所述目标应用的应用访问事件的事件特征信息。
在本申请中，本***的网络设备1通过基于对应的事件描述信息，对所获取的用户设备中目标应用的应用访问数据进行处理，以确定所述目标应用的应用访问事件的事件特征信息，在此，基于所述自定义的事件描述信息，可以有针对性地对获取符合事件描述的应用访问数据，并对其进行统计分析，从而为后续的信息处理和应用提供有利的数据基础。与所述网络设备1相配合，所述用户设备2基于所述事件描述信息，预先在目标应用中设置应用访问数据的采集触发条件，从而可以通过有针对性的埋点，有效地获取应用访问数据，使得所述网络设备1获取的应用访问数据即为后续数据处理需要的目标数据，相比与将用户对应用的全部访问操作对应的访问相关信息都纳入进所述网络设备1获取的应用访问数据，此优选实施例，能够使得应用访问数据获取或采集的工作量大大简化，并提高了所述网络设备1在后续数据处理中的准确性和效率。
图4示出根据本申请另一个优选实施例的一种用户处理应用访问数据的网络设备1的设备示意图。其中所述网络设备1包括第一装置401、第二装置402和第四装置403。
其中，所述第一装置401获取关于对应用户设备中目标应用的应用访问数据；第二装置402基于对应的事件描述信息对所述应用访问数据进行处理，以确定关于所述目标应用的应用访问事件的事件特征信息；所述第四装置403基于所述事件特征信息识别所述应用访问数据对应的访问者。在此，图4中所述第一装置401和第二装置402与图1中所述第一装置101和第二装置102对应相同或基本相同，故此处不再赘述，并通过引用的方式包含于此。
具体地，所述第四装置403基于所述事件特征信息识别所述应用访问数据对应的访问者。在此，可以基于所述网络设备1确定的事件特征信息，对所述各个目标应用对应的用户基于各种维度进行划分。在此，所述一个用户设备中目标应用对应的事件特征信息，可以直接地反映该事件特征信息对应的访问者的行为特征。若是不同设备上的同一应用、或是同类应用的相同应用访问事件具有可比性，则可以通过同一应用、或同类应用访问事件对应的事件特征信息的差异或是相似程度的分析，进而对事件特征信息对应的应用访问事件进行相应的区分、识别。在此，以应用场景为识别所述目标应用的访问者是虚假用户、还是真实用户为例，例如，所述目标应用的虚假用户可能通过虚假刷机或是模拟器等方式完成用户激活，则可能存在很多统计特征上的问题，如，在特定维度 上，虚假用户的事件特征信息的相似性概率极高，如，相比于真实用户，虚假用户每次访问设备的平均时长极短，大部分平均不足1秒，则基于该访问设备的平均时长对应的事件特征信息，可以对所述虚假用户进行一定程度上的识别，若是，在一段时间内，或是多段时间内，目标访问者对于目标应用的访问设备的平均时长这一事件特征信息基本不足1秒，若设置仅以此事件特征信息为所述真假访问者识别的标准，则可以推定该访问者为虚假用户。进一步，基于实际应用场景的需要，可以综合考虑多种事件特征信息作为划分识别的条件。在此，同一应用的不同的访问者可以是分别在不同设备上登录目标应用的不同用户，也可以是在同一设备上登录目标应用的不同用户。
在此，本领域技术人员应能理解所述以应用场景为识别所述目标应用的访问者是虚假用户、还是真实用户为例仅为举例，其他现有的或今后可能出现的其他可能应用场景，例如基于其他维度，如不限于访问者购买力、兴趣爱好等其他维度的访问者分类场景，如可适用于本发明，也应包含在本发明保护范围以内，并在此以引用方式包含于此。
在此，本申请基于所获取的应用访问事件的事件特征信息，结合相应的算法，可以灵活地实现各类具体应用场景下的信息分类识别。
优选地，所述第四装置403基于所述事件特征信息，通过分类算法对应用访问数据对应的访问者进行识别。
具体地，所述分类算法包括机器学习分类算法，即基于所述事件特征信息，借助机器学习训练，对应用访问数据对应的访问者进行分类识别。在此，所述机器学习分类算法包括基于所述事件特征信息进行相应的模型创建，进而基于创建的模型完成对所述访问者的划分识别。
在机器训练并建立所述模型的过程中，若是对于所述访问者的划分已有预期，例如，希望将在特定应用访问事件上表现较差的访问者判断为虚假概率高的用户，则可以优选所述机器学习分类算法来对应用访问数据对应的访问者进行识别，此时，可以通过自定义相应规则来进行数据标注训练，从而产生可以作为访问者识别标准的模型。所述机器学习分类算法可以包括但不限于逻辑回归算法、随机森林算法等算法。以逻辑回归算法为例，对所述访问者的识别过程如下：假设在训练完成后产生一个模型M，其中，M的输出结果标注为两类U和V，在汇总了一个目标应用对应的用户设备一天的应用访问日志后，所述网络设备1基于对所述应用访问日志对应的应用访问数据进行处理，确定得到所述目标应用访问者的应用访问事件的事件特征信息F，将所述事件特征信息F输入到所述模型M中，基于所述模型M可以得出所述事件特征信息F属于U或是V的结论。 此外，还可以计算所述事件特征信息F隶属于上述各个分类的相应概率，从而，基于生产的隶属概率P的大小来判断所述事件特征信息F属于U或是V。在此，所述模型对应的分类不限于所述两类，而是可以基于实际的应用场景的需要任意增减、变换相应分类，例如，可以以离散的或是连续的值对应不同的识别划分，如基于隶属概率的数值进行连续划分对于各类别划分结果等。
此外，在通过机器学习处理对应访问数据对应的访问者进行识别之前，优选地，对所述事件特征信息进行归一化处理，所述归一化处理包括分别在不同维度内部进行归一化处理，即同一类应用访问事件之间才具有可比性，对于同一类应用访问事件对应的时间特征信息进行归一化处理。
更优选地，所述第四装置基于所述事件特征信息，通过聚类算法对应用访问数据对应的访问者进行识别。
具体地，所述聚类算法包括机器学习聚类算法，即基于所述事件特征信息，借助机器学习训练，对应用访问数据对应的访问者进行聚类识别。在此，所述机器学习聚类算法包括基于所述事件特征信息进行相应的模型创建，进而基于创建的模型完成对所述访问者的划分识别。
在此，若是对于所述访问者的划分没有预先定义，则还可以优选所述机器聚类算法来对应用访问数据对应的访问者进行识别，此时，不需要自定义规则和进行标准训练，而是只要基于所述一定的聚类准则，例如基于一定的距离算法，如确定所述访问者之间的欧式距离，通过所述算法运行后，会自动将多类用户按照既定的距离进行分类。例如，假设在训练完成后产生一个模型N，其中，定义N的聚类数为2，如设定聚类K和J，同时对应着着所述类K和J的中心NK和NJ，所述中心NK和NJ的数据形态可以理解为体现了聚类类别的标准性特征，进而在汇总了一个目标应用对应的用户设备一天的应用访问日志后，所述网络设备1基于对所述应用访问日志对应的应用访问数据进行处理，确定得到所述目标应用访问者的应用访问事件的事件特征信息E，将所述事件特征信息E输入到所述模型N中，基于所述模型N可以分别计算出事件特征信息E到两类数据中心NK和NJ的距离，对应为距离值LK和LJ，进而基于所述E对应的距离值LK和LJ的区别来判断所述相应访问者的划分，例如，距离值LK相比于LJ更小，即所述事件特征信息与类K表现出的特征更接近，则说明所述事件特征信息对应的访问者隶属于K类的概率更大，反之则隶属于J类更大。在此，所述模型对应的聚类数不限于所述两类，而是可以基于实际的应用场景的需要任意增减、变换相应的聚类。
此外，在通过聚类算法对应访问数据对应的访问者进行识别之前，优选地，对所述事件特征信息进行归一化处理，所述归一化处理包括分别在不同维度内部进行归一化处理，即同一类应用访问事件之间才具有可比性，对于同一类应用访问事件对应的时间特征信息进行归一化处理。
优选地，所述网络设备1还包括第五装置(未示出)，所述第五装置基于预置的访问者可信度指标，并结合所述访问者对应的识别结果，确定所述访问者的可信度信息。
具体地，基于所述机器学习处理能够确定的实际上是所述访问者类别划分的可能性。例如，在通过所述机器学习分类算法来对应用访问数据对应的访问者进行识别中，可以基于所述事件特征信息对应的隶属概率大小来判断所述事件特征信息的归属。又如，在在通过所述机器学习聚类分类算法来对应用访问数据对应的访问者进行识别中，可以基于所述事件特征信息与各个聚类中心的距离值区别来判断所述事件特征信息的归属。在此，对于上述事件特征信息对应的隶属概率、或是所述事件特征信息与各个聚类中心的距离值区别，都是可以基于实际需要自定义的。当设置不同时，会直接对所述事件特征信息的类别归属产生影响，例如，同一个事件特征信息，在隶属概率设置为P1时，该事件特征信息对应的应用访问事件的访问者可能判定为真实用户，但是若是隶属概率设置为P2，则有可能将该同一个访问者判定为虚假用户。在此，当选择适合的机器学习算法，并建立了相应的模型后，可以基于实际需要预先设置访问者可信度指标，以基于所述机器学习分类算法来对应用访问数据对应的访问者进行识别为例，所述可信度指标可以包括基于隶属概率的分级指标，例如，设置隶属于真实用户对应的隶属概率P，其中0≤P≤1，可以设置当80％≤P≤100％时，判定为真实用户；设置当0≤P<50％时，判定为虚假用户；设置当50％≤P<80％时，可以暂定为疑似虚假用户，等待进一步检验。进而，结合所述访问者对应的识别结果，例如，某个访问者G对应的隶属概率P为90％，则认定该问者的可信度信息为真实用户。又如，若是P为60％，则认定该问者的可信度信息为疑似虚假用户，可以进行进一步的分析判断，如基于其他类型的应用访问事件对应的事件特征信息的分析再次判断。
在此，本领域技术人员应能理解所述可信度指标可以包括基于隶属概率的分级指标仅为举例，其他现有的或今后可能出现的其他形式的可信度指标如可适用于本发明，也应包含在本发明保护范围以内，并在此以引用方式包含于此。
在此，本领域技术人员应能理解所述可信度信息的具体内容仅为举例，其他现有的或今后可能出现的其他形式的可信度信息如可适用于本发明，也应包含在本发明保护范 围以内，并在此以引用方式包含于此。
在此，本申请基于应用访问者的识别结果，并结合预置的访问者可信度指标，可以确定访问者的可信度信息，从而能够更实际地反映应用内用户的真实可信信息，从而更好的维护、改进和完善目标应用的应用效果。
优选地，所述网络设备1还包括第六装置(未示出)，所述第六装置基于所述访问者的可信度信息，对所述目标应用进行访问控制。
具体地，在实际应用中，基于认定的所述访问者的可信度信息，可以对所述用户设备上的目标应用进行相应的访问控制，例如，对于认定不是真实用户的访问者，可以采取发送警告，发送身份验证信息，限制访问权限、封锁用户账号等多种形式的访问控制。在此，优选地，所述访问控制还可以基于不同的可信度信息而有所不同，例如，对于确定为虚假用户的访问账号，可以直接封锁账号；而对于确定为疑似虚假用户的访问者，可以通过发送身份验证信息，限制部分访问权限等方式对所述访问者进行有限限制，并基于进一步的识别，或结合所述访问者的补救措施，再次对所述目标应用进行限制消除，或是加深访问控制等后续操作。
在实际应用中，所述应用的访问者是真实用户还是虚假用户，对于应用服务范围的评估、服务推广、广告赞助的获得等方面都有直接的影响，所以对于识别出的虚假用户，要进行相应的访问控制和处理，从而更好的维护、改进和完善目标应用的应用效果。
图5示出根据本申请再一个方面的一种在网络设备端用于处理应用访问数据的方法示意图；
其中，在步骤S501中，所述网络设备1获取关于对应用户设备中目标应用的应用访问数据；在步骤S502中，所述网络设备1基于对应的事件描述信息对所述应用访问数据进行处理，以确定关于所述目标应用的应用访问事件的事件特征信息。
具体地，在步骤S501中，所述网络设备1获取关于对应用户设备中目标应用的应用访问数据。在此，所述用户设备包括但不限于各种类型的PC、移动电话、平板电脑、以及其他各种可以装载对应目标应用的终端设备。所述目标应用包括但不限于与各种终端设备相对应的应用类型。在此，所述目标应用与所述用户设备相对应，以所述终端设备是移动终端，如移动电话、平板电脑等为例，所述目标应用可以是基于苹果iOS***的ipa，pxl，deb等格式的应用，也可以是基于安卓***的apk格式的应用，还可以是基于微软windowsphone***的xap格式的应用，等等。在此，所述应用访问数据包括基于用户在所述终端设备的所述目标应用中进行的访问操作所确定的访问相关信息。例如，所 述访问操作包括用户点击进入应用的某一页面、用户点击应用的某一控件等，基于所述访问操作，所述访问数据包括用户访问应用的页面信息、用户在该页面停留的时间、用户点击应用中相应控件的次数、用户在一定时间内访问所述应用消耗的流量信息，等等。在此，所述网络设备1获取的访问数据的具体种类可以基于实际需要进行设置。例如，可以不加选择的将用户对应用的全部访问操作对应的访问相关信息都纳入进所述网络设备1获取的应用访问数据中；又如，还可以基于不同目标应用的特点有针对性的设置对应的应用访问数据的种类和内容；再如，还可以基于应用访问数据处理后的实际应用场景有针对性地确定所述应用访问数据的种类和内容。
在此，所述应用访问数据的获取可以是周期性获取，或是根据实际应用场景设定其他的获取条件。此外，所述应用访问数据可以直接从所述目标应用对应的用户设备中获取。例如，可以通过读取目标应用对应的应用访问日志来获取所述应用访问数据。此外，所述应用访问数据还可以从与所述目标应用所述在用户设备相对应的第三方设备中获取所述应用访问数据，所述第三方设备包括能够获取、存储所述应用访问数据的设备，如所述用户设备对应的同步设备、或是存储设备等。
接着，在步骤S502中，所述网络设备1基于对应的事件描述信息对所述应用访问数据进行处理，以确定关于所述目标应用的应用访问事件的事件特征信息。
具体地，所述网络设备1获取的所述应用访问数据包括基于用户在所述终端设备的所述目标应用中进行的访问操作所确定的访问相关信息。在此，基于用户对应用的访问操作定义了相应的应用访问事件，例如，用户点击登录键登录应用，则可以定义相应的应用访问事件为登录。在此，一个访问操作可能对应一个或多个应用访问事件，例如，用户点击进入一个页面，可以同时对应登录页面信息和登录页面次数两个应用访问事件。应用访问事件的定义可以基于实际应用的运行特征、或是基于对该目标应用的应用访问数据处理后的实际应用场景的需要进行设置。在此，所述事件描述信息与所述应用访问事件对应，所述事件描述信息包含对所述应用访问事件的具体描述，在此，优选地，所述事件描述信息可以包括所述应用访问事件的事件名称，对应用访问事件的内容描述信息，应用访问事件对应的处理信息，等等。例如，所述应用访问事件的事件名称可以为任意能够唯一确定该事件的字符串；又如，所述应用访问事件的描述内容可以为任意字符串，其目的是帮助分辨事件的具体内容；再如，所述应用访问事件的处理信息可以包括运算信息，目的是对所述应用访问事件进行特征量化，如，可以是事件内容的数量运算、求和运算、求平均值运算等等。以所述用户点击登录键登录应用这一操作为例，可 以定义所述应用访问事件的时间名称为A1，所述应用访问事件的描述内容为登录；所述应用访问事件的处理信息为设置算子count，在此，所述算子count即对应于登录次数计算。
其中，所述目标应用对应的事件描述信息可以由所述网络设备1从任意可能的服务器设备中获取，在此，优选地，所述目标应用对应的事件描述信息还可以由应用开发者根据实际需要直接在所述网络设备1中设置，进一步，可以针对每一个目标应用分别设置对应的若干个应用访问事件，并设置对应的事件描述信息。在此，不同目标应用，或是不同种类的目标应用可以对应不同、或是相同的应用访问事件、或是事件描述信息的设置。
在此，所述网络设备1基于所述事件描述信息对所述应用访问数据进行处理可以包括将所获得的应用访问数据与相应的事件描述信息进行匹配，若是匹配成功，则基于事件描述信息中预先设置的应用访问事件对应的计算或是统计分析方式确定相应的事件特征信息。可以基于所述应用访问数据的不同形式内容，对所述应用访问数据做不同的处理。例如，当所述应用访问数据为来自所述目标应用所在用户设备的应用访问日志时，假设读取了一行日志，则可以先基于预设的分隔符对该行日志对应的字符串进行分解，获得相应字符子串，再基于所述字符子串，与该目标应用对应的所述事件描述信息进行匹配。如果所述匹配成功，则基于所述事件描述信息中对应的具体描述信息，如所述应用访问事件的运算信息，对所述应用访问数据进行相应计算或统计，从而确定所获得的该应用访问数据对应的目标应用的应用访问事件的事件特征信息，并进一步，对所述事件特征信息进行特定的归类统计，如，设置以用户设备为主键的数据库，并将所述事件特征信息存入该数据库，进一步，基于后续所述时间特征信息的确定更新所述数据库信息。如果所述匹配不成功，则所述应用访问数据对应的可能是未定义的应用访问事件，则忽略不做处理。
在此，本申请的网络设备1通过基于对应的事件描述信息，对所获取的用户设备中目标应用的应用访问数据进行处理，以确定所述目标应用的应用访问事件的事件特征信息。事件特征信息可以反映一个用户设备中目标应用在相应访问操作中的相关情况，对一个目标应用一个事件特征信息分析、或是若干个事件特征信息的综合分析，可以为后续的信息处理和应用提供有利的数据基础。例如，若是不同设备上的同一应用、或是同类应用的相同应用访问事件具有可比性，则可以通过同一应用、或同类应用访问事件对应的事件特征信息的差异或是相似程度的分析，进而对事件特征信息对应的应用访问事 件进行相应的区分、识别。
优选地，所述步骤S502包括子步骤S5021(未示出)和子步骤S5022(未示出)，其中，在子步骤S5021中，所述网络设备1基于所述事件描述信息对所述应用访问数据进行日志分析，以获得关于所述目标应用的一个或多个应用访问事件；在子步骤S5022中，所述网络设备1对所述一个或多个应用访问事件进行统计处理以获得对应的事件特征信息。
具体地，在子步骤S5021中，所述网络设备1基于所述事件描述信息对所述应用访问数据进行日志分析，以获得关于所述目标应用的一个或多个应用访问事件。在此，本申请中，所述网络设备1获取的应用访问数据可以有多种形式内容，不同形式的应用访问数据会对应不同的数据处理。在此，优选地，基于所述目标应用所对应的用户设备设置的日志统计服务，获取所述应用访问数据对应的应用访问日志，进而基于对所述应用访问日志进行日志分析来确定所述目标应用对应的应用访问事件。应用访问日志本身对应的是非结果化的文本文件，但其中包含着可以结构化出来的信息。所述日志分析包括：首先对所述应用访问日志进行逐行分解，然后基于该分解的结果，并结合所述事件描述信息，确定所述目标应用对应的应用访问事件。具体地，不同格式的应用访问日志需要对应于不同的日志解析规则，基于已有或是自定义的日志解析规则对所述应用访问日志进行相应解析。例如，逐行读取获得的应用访问日志，优选地，每一行日志对应于一个应用访问事件，若是有多个访问操作信息，可以以多条日志的形式分别记录。进而，按照预先定义好的分隔符对所述应用访问日志进行字符串分解，分解后的各个字符子串可能分别对应于相应的的应用访问事件，也可能若干个字符子串的内容共同对应于一个应用访问事件，再将该应用访问事件与所述目标应用对应的事件描述信息中定义的应用访问事件进行对照，从而记录下该应用访问日志中需要留用的应用访问事件。所述字符子串对应的应用访问事件与所述目标应用对应的事件描述信息中定义的应用访问事件进行对照，可以是基于相同或相似的事件描述信息而进行，在此，优选地，所述网络设备1获取的应用访问日志与应用访问事件对应的事件描述信息中定义的应用访问事件，基于自定义的事件名称进行匹配，例如，某应用访问事件的事件名称对应于唯一的字符串B1。所述应用访问日志中事件名称等相关信息可以是在用户设备采集应用访问数据之前就设置在预定格式中的。例如，所述用户设备基于从所述网络设备1获取的所述目标应用的事件描述信息进行采集埋点，进而，在采集应用访问数据时，对应的应用访问日志信息中每一个应用访问事件都对应记录一个唯一的事件名称。从而，基于所述事件名称信息， 可以确定所述应用访问数据中有哪些目标应用对应设置的应用访问事件。
接着，在子步骤S5022中，所述网络设备1对所述一个或多个应用访问事件进行统计处理以获得对应的事件特征信息。
具体地，当基于所述目标应用的应用访问数据确定了若干个应用访问事件后，基于该应用访问事件对应的事件描述信息，可以对所述应用访问事件进行计算、统计处理。具体统计处理方法取决于所述事件描述信息的设置。所述事件特征信息，即对应于基于所述事件描述信息对所述应用访问事件进行处理的结果，优选地，所述事件特征信息还可以包括对若干个同一应用访问事件的处理结果的统计结果。例如，若是所述事件描述信息包括对所述应用访问事件进行定性判断，则基于所述定性判断的信息，确定该应用访问事件的性质，进而以此作为该应用访问事件的事件特征信息。又如，若是所述事件描述信息包括对所述应用访问事件进行定量分析，如，对所述应用访问事件的内容进行不限于数量运算、求和运算、求平均值运算等类别的运算，则基于相应的运算信息对所述应用访问事件进行特征量化，从而将各个应用访问事件的量化结果确定为事件特征信息。
更优选地，在所述方法中，所述事件描述信息包括对应事件的运算符信息，其中，其中，所述第二单元基于所述应用访问事件所对应的所述运算符信息，对所述一个或多个应用访问事件进行统计处理以获得对应的事件特征信息。
具体地，所述运算符信息包括不限于数量运算、求和运算、求平均值运算等类别的运算，如，分别对应于算子count、sum、avg等。例如，假设目标应用存在于设备a1上，基于该设备a1上目标应用的事件描述信息，确定对应一个应用访问事件C1，内容描述为访问页面x，对应的运算符信息为count，则基于该事件描述信息，对获取的应用访问日志进行解析后，得到的该对应事件的事件特征信息可能是：应用访问事件C1：n，在此，n可以为一定事件内用户访问页面x的次数。在此，对于量化的所述事件特征信息，不同应用访问事件可以对应不同的量化单位。此外，具体应用中，还可以在事件描述信息中自定义所述事件特征信息时间维度，例如默认按天统计，可以在应用访问日志中包含日志时间，并在所述日志解析过程中加入特定的代码逻辑来定义时间，以满足实际需要。
优选地，所述在网络设备端用于处理应用访问数据的方法还包括步骤S503(未示出)，在所述步骤S503中，所述网络设备1基于所述事件特征信息生成对应的图示信息，并显示所述图示信息。
具体地，在此，所述图示信息包括但不限于直方图、饼图等各种类型的图形描述信息。以所述直方图为例，在通用算法领域，直方图可以用作为对各类特征集合进行形象的描述。在此，可以直接将对应于所述事件特征信息的直方图输入到目标识别分类器中，进行后续的划分识别。在此，所定义的应用访问事件可以不局限于具体形态，任意形式定义的应用访问事件都可以很直观、并且很方便的通过所述图示信息显示出来。此外，基于所述图示信息、例如所述直方图的图形结构，对事件特征信息之间的差异性也可以进行更加直观形象的对比分析。例如，在通过所述机器聚类算法来对应用访问数据对应的访问者进行识别过程中，可以基于所述一定的聚类准则，例如，基于一定的距离算法，如确定所述访问者之间的欧式距离，通过所述算法运行后，会自动将多类用户按照既定的距离进行分类，此时，若是所述访问者对应的事件特征信息有相应的直方图信息，则可以直接基于所述访问者之间的直方图距离来对所述访问者进行分类。
图6示出根据本申请一个优选实施例的一种在网络设备端用于处理应用访问数据的方法示意图。
其中，在步骤S601中，所述网络设备1获取目标应用对应的事件描述信息；在步骤S602中，所述网络设备1将所述事件描述信息提供至安装所述目标应用的对应用户设备；其中，在步骤S603中，所述网络设备1获取所述用户设备返回的关于所述目标应用的应用访问数据；其中，在步骤S604中，所述网络设备1基于所述事件描述信息对所述应用访问数据进行处理，以确定关于所述目标应用的应用访问事件的事件特征信息。
具体地，在此，在步骤S601中，所述网络设备1获取目标应用对应的事件描述信息。每一个目标应用对应于一个或多个应用访问事件的事件描述信息，所述事件描述信息包含对对应所述应用访问事件的具体描述。优选地，不同设备的同一目标应用对应于相同的一组应用访问事件的事件描述信息；不同设备或是同一设备上的相似应用也可以对应于相同一组或不同组的应用访问事件的事件描述信息。在此，优选地，所述事件描述信息可以直接由应用开发者根据各个不同应用的实际需要直接在所述网络设备1中设置。此外，进一步，所述事件描述信息还可以从其他可能的第三方设备或是数据库中获取，例如，基于用户对各种类型应用可能的访问操作，定义相应的应用访问事件，并设置对应的事件描述信息，并将该全部的应用访问时间和对应的事件描述信息预先存储在一个第三方设备中，基于不同的网络设备1各自对应的用户设备的目标应用的类型，不同的网络设备1可以直接在所述第三方设备中寻找与所述目标应用匹配的事件描述信息，若是有相匹配的事件描述信息则直接读取使用，若是没有可匹配的事件描述信息，则再进 行相应事件描述信息的自定义。对于各个网络设备1自定义的事件描述信息，可以在定义后同步到所述第三方设备中，从而实现第三方设备中相应事件描述信息的实时更新、扩充。
接着，在步骤S602中，所述网络设备1将所述事件描述信息提供至安装所述目标应用的对应用户设备。
在本申请中，所述网络设备1获取的所述目标应用的应用访问数据可以是不加选择的将用户对应用的全部访问操作对应的访问相关信息都纳入进所述网络设备1获取的应用访问数据中；又如，还可以基于不同目标应用的特点有针对性的设置对应的应用访问数据的种类；再如，还可以基于应用访问数据处理后的实际应用场景有针对性地确定所述应用访问数据的种类。在此，优选地，在安装所述目标应用的对应用户设备中预先进行设置，从而直接获取需要实际需要进行后续处理的应用访问数据。在此，即可以通过将所述网络设备1获取的事件描述信息提供至所述目标应用对应的用户设备这一操作，从而使得，所述用户设备可以基于所述事件描述信息进行相应的有针对性的应用访问数据的采集。例如，若是目标应用只需要采集登陆、访问页面时长、点击控件次数这几个应用访问事件对应的应用访问数据，则所述用户设备基于获取的上述各个应用访问事件的事件描述信息即可以针对性的采集相应的应用访问数据，而对于该事件描述信息中没有定义的其他应用访问事件，在后续操作中，所述用户设备则不会在将其返回给网络设备1。在此，所述用户设备可以基于所述事件描述信息直接设置所述目标应用的应用访问数据的采集触发条件，从而采集到所述网络设备1需要的应用访问数据；所述用户设备还可以先不加选择的采集全部访问操作对应的访问相关信息，再基于所述访问相关信息进行筛选，从而确定所述网络设备1需要获取的应用访问数据。
接着，在步骤S603中，所述网络设备1获取所述用户设备返回的关于所述目标应用的应用访问数据。在此，优选地，基于所述网络设备1提供至所述目标应用对应的用户设备的事件描述信息，所述用户设备将确定相对应的应用访问数据。进而，所述网络设备1从所述用户设备获取确定的该应用访问数据。接着，在步骤S604中，再次基于所述目标应用对应的事件描述信息，所述网络设备1对从所述用户设备返回的所述目标应用的应用访问数据，进行相应的处理，进而确定对应应用访问事件的事件特征信息。在此，所述网络设备1获取的目标应用的应用访问数据可以是直接由所述用户设备返回的，也可能由存储了所述应用访问数据的三方设备，如所述用户设备对应的同步设备、或是存储设备等发送来的。
在此，本申请通过将所述目标应用对应的事件描述信息预先提供至所述目标应用对应的用户设备，从而对从用户设备获取的应用访问数据进行了针对性筛选，使得所述网络设备1获取的应用访问数据即为后续数据处理需要的目标数据，相比与将用户对应用的全部访问操作对应的访问相关信息都纳入进所述网络设备1获取的应用访问数据，此优选操作，能够使得应用访问数据获取或采集的工作量大大简化，并提高了所述网络设备1在后续数据处理中的准确性和效率。
图7示出根据本申请一个优选实施例的一种用于处理应用访问数据的方法示意图。
其中，在步骤S701中，所述网络设备1获取目标应用对应的事件描述信息；在步骤S703中，所述网络设备1将所述事件描述信息提供至安装所述目标应用的对应用户设备；在步骤S702中，所述用户设备2基于所述事件描述信息设置关于所述目标应用的应用访问数据的采集触发条件；在步骤S704中，所述用户设备2基于所述采集触发条件采集所述应用访问数据；在步骤S705中，所述网络设备1获取所述用户设备返回的关于所述目标应用的应用访问数据；在步骤S707中，所述网络设备1基于所述事件描述信息对所述应用访问数据进行处理，以确定关于所述目标应用的应用访问事件的事件特征信息。在此，图7中所述步骤S701、步骤S703、步骤S705、步骤S707与图6中所述步骤S601、步骤S602、步骤S603、步骤S604分别对应相同或基本相同，故此处不再赘述，并通过引用的方式包含于此。
具体地，在步骤S702中，所述用户设备2基于所述事件描述信息设置关于所述目标应用的应用访问数据的采集触发条件。所述事件描述信息与所述应用访问事件对应，所述事件描述信息包含对所述应用访问事件的具体描述，在此，优选地，所述事件描述信息可以包括所述应用访问事件的事件名称，对应用访问事件的内容描述信息，应用访问事件对应的运算信息，等等。在此，优选地，所述目标应用的事件描述信息可以直接从对应的网络设备1中获取。此外，在实际应用中，也可以从其他任意可能的服务器设备中获取。在此，优选地，通过采集用户访问操作对应的应用访问日志来获取目标应用的应用访问数据，所述采集触发条件可以基于事件描述信息确定，例如，设置当出现某应用访问事件对应的用户访问操作时，即确定为触发条件满足。进而通过日志埋点的方式预先在所述用户设备2对应的目标应用中进行设置。例如，可以将需要采集的应用访问事件的事件名称、内容描述信息借助log(日志)代码的形式进行手动埋点、或是在业务逻辑复杂时，进行自动化埋点。当用户实施了相应的访问操作，则确定满足所述采集触发条件。
接着，在步骤S704中，所述用户设备2基于所述采集触发条件采集所述应用访问数据。在此，优选地，以拉取所述应用访问日志的形式采集所述应用访问数据。可以是基于所述采集触发条件，直接设置与所述事件描述信息对应的专门的应用访问日志；也可以基于所述采集触发条件，从包含了全部应用访问日志的日志文件中读取与所述事件描述信息匹配的相应部分的应用访问日志。
在本申请中，本***的网络设备1通过基于对应的事件描述信息，对所获取的用户设备中目标应用的应用访问数据进行处理，以确定所述目标应用的应用访问事件的事件特征信息，在此，基于所述自定义的事件描述信息，可以有针对性地对获取符合事件描述的应用访问数据，并对其进行统计分析，从而为后续的信息处理和应用提供有利的数据基础。与所述网络设备1相配合，所述用户设备2基于所述事件描述信息，预先在目标应用中设置应用访问数据的采集触发条件，从而可以通过有针对性的埋点，有效地获取应用访问数据，使得所述网络设备1获取的应用访问数据即为后续数据处理需要的目标数据，相比与将用户对应用的全部访问操作对应的访问相关信息都纳入进所述网络设备1获取的应用访问数据，此优选实施例，能够使得应用访问数据获取或采集的工作量大大简化，并提高了所述网络设备1在后续数据处理中的准确性和效率。
图8示出根据本申请另一个优选实施例的一种在网络设备端用于处理应用访问数据的方法示意图。
其中，在步骤S801中，所述网络设备1获取关于对应用户设备中目标应用的应用访问数据；在步骤S802中，所述网络设备1基于对应的事件描述信息对所述应用访问数据进行处理，以确定关于所述目标应用的应用访问事件的事件特征信息；在步骤S803中，所述网络设备1基于所述事件特征信息识别所述应用访问数据对应的访问者。在此，图8中所述步骤S801和步骤S802与图5中所述步骤S501和步骤S502对应相同或基本相同，故此处不再赘述，并通过引用的方式包含于此。
具体地，在步骤S803中，所述网络设备1基于所述事件特征信息识别所述应用访问数据对应的访问者。在此，可以基于所述网络设备1确定的事件特征信息，对所述各个目标应用对应的用户基于各种维度进行划分。在此，所述一个用户设备中目标应用对应的事件特征信息，可以直接地反映该事件特征信息对应的访问者的行为特征。若是不同设备上的同一应用、或是同类应用的相同应用访问事件具有可比性，则可以通过同一应用、或同类应用访问事件对应的事件特征信息的差异或是相似程度的分析，进而对事件特征信息对应的应用访问事件进行相应的区分、识别。在此，以应用场景为识别所述目 标应用的访问者是虚假用户、还是真实用户为例，例如，所述目标应用的虚假用户可能通过虚假刷机或是模拟器等方式完成用户激活，则可能存在很多统计特征上的问题，如，在特定维度上，虚假用户的事件特征信息的相似性概率极高，如，相比于真实用户，虚假用户每次访问设备的平均时长极短，大部分平均不足1秒，则基于该访问设备的平均时长对应的事件特征信息，可以对所述虚假用户进行一定程度上的识别，若是，在一段时间内，或是多段时间内，目标访问者对于目标应用的访问设备的平均时长这一事件特征信息基本不足1秒，若设置仅以此事件特征信息为所述真假访问者识别的标准，则可以推定该访问者为虚假用户。进一步，基于实际应用场景的需要，可以综合考虑多种事件特征信息作为划分识别的条件。在此，同一应用的不同的访问者可以是分别在不同设备上登录目标应用的不同用户，也可以是在同一设备上登录目标应用的不同用户。
在此，本领域技术人员应能理解所述以应用场景为识别所述目标应用的访问者是虚假用户、还是真实用户为例仅为举例，其他现有的或今后可能出现的其他可能应用场景，例如基于其他维度，如不限于访问者购买力、兴趣爱好等其他维度的访问者分类场景，如可适用于本发明，也应包含在本发明保护范围以内，并在此以引用方式包含于此。
在此，本申请基于所获取的应用访问事件的事件特征信息，结合相应的算法，可以灵活地实现各类具体应用场景下的信息分类识别。
优选地，在步骤S803中，所述网络设备1基于所述事件特征信息，通过分类算法对应用访问数据对应的访问者进行识别。
具体地，所述分类算法包括机器学习分类算法，即基于所述事件特征信息，借助机器学习训练，对应用访问数据对应的访问者进行分类识别。在此，所述机器学习分类算法包括基于所述事件特征信息进行相应的模型创建，进而基于创建的模型完成对所述访问者的划分识别。
在机器训练并建立所述模型的过程中，若是对于所述访问者的划分已有预期，例如，希望将在特定应用访问事件上表现较差的访问者判断为虚假概率高的用户，则可以优选所述机器学习分类算法来对应用访问数据对应的访问者进行识别，此时，可以通过自定义相应规则来进行数据标注训练，从而产生可以作为访问者识别标准的模型。所述机器学习分类算法可以包括但不限于逻辑回归算法、随机森林算法等算法。以逻辑回归算法为例，对所述访问者的识别过程如下：假设在训练完成后产生一个模型M，其中，M的输出结果标注为两类U和V，在汇总了一个目标应用对应的用户设备一天的应用访问日志后，所述网络设备1基于对所述应用访问日志对应的应用访问数据进行处理，确定得 到所述目标应用访问者的应用访问事件的事件特征信息F，将所述事件特征信息F输入到所述模型M中，基于所述模型M可以得出所述事件特征信息F属于U或是V的结论。此外，还可以计算所述事件特征信息F隶属于上述各个分类的相应概率，从而，基于生产的隶属概率P的大小来判断所述事件特征信息F属于U或是V。在此，所述模型对应的分类不限于所述两类，而是可以基于实际的应用场景的需要任意增减、变换相应分类，例如，可以以离散的或是连续的值对应不同的识别划分，如基于隶属概率的数值进行连续划分对于各类别划分结果等。
此外，在通过机器学习处理对应访问数据对应的访问者进行识别之前，优选地，对所述事件特征信息进行归一化处理，所述归一化处理包括分别在不同维度内部进行归一化处理，即同一类应用访问事件之间才具有可比性，对于同一类应用访问事件对应的时间特征信息进行归一化处理。
更优选地，在步骤S803中，所述网络设备1基于所述事件特征信息，通过聚类算法对应用访问数据对应的访问者进行识别。
具体地，所述聚类算法包括机器学习聚类算法，即基于所述事件特征信息，借助机器学习训练，对应用访问数据对应的访问者进行聚类识别。在此，所述机器学习聚类算法包括基于所述事件特征信息进行相应的模型创建，进而基于创建的模型完成对所述访问者的划分识别。
在此，若是对于所述访问者的划分没有预先定义，则还可以优选所述机器聚类算法来对应用访问数据对应的访问者进行识别，此时，不需要自定义规则和进行标准训练，而是只要基于所述一定的聚类准则，例如基于一定的距离算法，如确定所述访问者之间的欧式距离，通过所述算法运行后，会自动将多类用户按照既定的距离进行分类。例如，假设在训练完成后产生一个模型N，其中，定义N的聚类数为2，如设定聚类K和J，同时对应着着所述类K和J的中心NK和NJ，所述中心NK和NJ的数据形态可以理解为体现了聚类类别的标准性特征，进而在汇总了一个目标应用对应的用户设备一天的应用访问日志后，所述网络设备1基于对所述应用访问日志对应的应用访问数据进行处理，确定得到所述目标应用访问者的应用访问事件的事件特征信息E，将所述事件特征信息E输入到所述模型N中，基于所述模型N可以分别计算出事件特征信息E到两类数据中心NK和NJ的距离，对应为距离值LK和LJ，进而基于所述E对应的距离值LK和LJ的区别来判断所述相应访问者的划分，例如，距离值LK相比于LJ更小，即所述事件特征信息与类K表现出的特征更接近，则说明所述事件特征信息对应的访问者隶属于K类的 概率更大，反之则隶属于J类更大。在此，所述模型对应的聚类数不限于所述两类，而是可以基于实际的应用场景的需要任意增减、变换相应的聚类。
此外，在通过聚类算法对应访问数据对应的访问者进行识别之前，优选地，对所述事件特征信息进行归一化处理，所述归一化处理包括分别在不同维度内部进行归一化处理，即同一类应用访问事件之间才具有可比性，对于同一类应用访问事件对应的时间特征信息进行归一化处理。
优选地，所述在网络设备端用于处理应用访问数据的方法还包括步骤S804(未示出)，在步骤S804中，所述网络设备1基于预置的访问者可信度指标，并结合所述访问者对应的识别结果，确定所述访问者的可信度信息。
具体地，基于所述机器学习处理能够确定的实际上是所述访问者类别划分的可能性。例如，在通过所述机器学习分类算法来对应用访问数据对应的访问者进行识别中，可以基于所述事件特征信息对应的隶属概率大小来判断所述事件特征信息的归属。又如，在在通过所述机器学习聚类分类算法来对应用访问数据对应的访问者进行识别中，可以基于所述事件特征信息与各个聚类中心的距离值区别来判断所述事件特征信息的归属。在此，对于上述事件特征信息对应的隶属概率、或是所述事件特征信息与各个聚类中心的距离值区别，都是可以基于实际需要自定义的。当设置不同时，会直接对所述事件特征信息的类别归属产生影响，例如，同一个事件特征信息，在隶属概率设置为P1时，该事件特征信息对应的应用访问事件的访问者可能判定为真实用户，但是若是隶属概率设置为P2，则有可能将该同一个访问者判定为虚假用户。在此，当选择适合的机器学习算法，并建立了相应的模型后，可以基于实际需要预先设置访问者可信度指标，以基于所述机器学习分类算法来对应用访问数据对应的访问者进行识别为例，所述可信度指标可以包括基于隶属概率的分级指标，例如，设置隶属于真实用户对应的隶属概率P，其中0≤P≤1，可以设置当80％≤P≤100％时，判定为真实用户；设置当0≤P<50％时，判定为虚假用户；设置当50％≤P<80％时，可以暂定为疑似虚假用户，等待进一步检验。进而，结合所述访问者对应的识别结果，例如，某个访问者G对应的隶属概率P为90％，则认定该问者的可信度信息为真实用户。又如，若是P为60％，则认定该问者的可信度信息为疑似虚假用户，可以进行进一步的分析判断，如基于其他类型的应用访问事件对应的事件特征信息的分析再次判断。
在此，本领域技术人员应能理解所述可信度指标可以包括基于隶属概率的分级指标仅为举例，其他现有的或今后可能出现的其他形式的可信度指标如可适用于本发明，也 应包含在本发明保护范围以内，并在此以引用方式包含于此。
在此，本领域技术人员应能理解所述可信度信息的具体内容仅为举例，其他现有的或今后可能出现的其他形式的可信度信息如可适用于本发明，也应包含在本发明保护范围以内，并在此以引用方式包含于此。
在此，本申请基于应用访问者的识别结果，并结合预置的访问者可信度指标，可以确定访问者的可信度信息，从而能够更实际地反映应用内用户的真实可信信息，从而更好的维护、改进和完善目标应用的应用效果。
优选地，所述在网络设备端用于处理应用访问数据的方法还包括步骤S805(未示出)，在步骤S805中，所述网络设备1基于所述访问者的可信度信息，对所述目标应用进行访问控制。
具体地，在实际应用中，基于认定的所述访问者的可信度信息，可以对所述用户设备上的目标应用进行相应的访问控制，例如，对于认定不是真实用户的访问者，可以采取发送警告，发送身份验证信息，限制访问权限、封锁用户账号等多种形式的访问控制。在此，优选地，所述访问控制还可以基于不同的可信度信息而有所不同，例如，对于确定为虚假用户的访问账号，可以直接封锁账号；而对于确定为疑似虚假用户的访问者，可以通过发送身份验证信息，限制部分访问权限等方式对所述访问者进行有限限制，并基于进一步的识别，或结合所述访问者的补救措施，再次对所述目标应用进行限制消除，或是加深访问控制等后续操作。
在实际应用中，所述应用的访问者是真实用户还是虚假用户，对于应用服务范围的评估、服务推广、广告赞助的获得等方面都有直接的影响，所以对于识别出的虚假用户，要进行相应的访问控制和处理，从而更好的维护、改进和完善目标应用的应用效果。
对于本领域技术人员而言，显然本发明不限于上述示范性实施例的细节，而且在不背离本发明的精神或基本特征的情况下，能够以其他的具体形式实现本发明。因此，无论从哪一点来看，均应将实施例看作是示范性的，而且是非限制性的，本发明的范围由所附权利要求而不是上述说明限定，因此旨在将落在权利要求的等同要件的含义和范围内的所有变化涵括在本发明内。不应将权利要求中的任何附图标记视为限制所涉及的权利要求。此外，显然“包括”一词不排除其他单元或步骤，单数不排除复数。装置权利要求中陈述的多个单元或装置也可以由一个单元或装置通过软件或者硬件来实现。第一，第二等词语用来表示名称，而并不表示任何特定的顺序。

Claims (23)

  1. 一种在网络设备端用于处理应用访问数据的方法，其中，所述方法包括：
    获取关于对应用户设备中目标应用的应用访问数据；
    基于对应的事件描述信息对所述应用访问数据进行处理，以确定关于所述目标应用的应用访问事件的事件特征信息。
  2. 根据权利要求1所述的方法，其中，该方法还包括：
    基于所述事件特征信息生成对应的图示信息，并显示所述图示信息。
  3. 根据权利要求1或2任意一项所述的方法，其中，该方法还包括：
    基于所述事件特征信息识别所述应用访问数据对应的访问者。
  4. 根据权利要求3所述的方法，其中，所述基于所述事件特征信息识别所述应用访问数据对应的访问者包括：
    基于所述事件特征信息，通过分类算法对应用访问数据对应的访问者进行识别。
  5. 根据权利要求3所述的方法，其中，所述基于所述事件特征信息识别所述应用访问数据对应的访问者包括：
    基于所述事件特征信息，通过聚类算法对应用访问数据对应的访问者进行识别。
  6. 根据权利要求3至5中任一项所述的方法，其中，所述方法还包括：
    基于预置的访问者可信度指标，并结合所述访问者对应的识别结果，确定所述访问者的可信度信息。
  7. 根据权利要求6所述的方法，其中，所述方法还包括：
    基于所述访问者的可信度信息，对所述目标应用进行访问控制。
  8. 根据权利要求1至7中任一项所述的方法，其中，该方法还包括：
    获取目标应用对应的事件描述信息；
    将所述事件描述信息提供至安装所述目标应用的对应用户设备；
    其中，所述获取关于对应用户设备中目标应用的应用访问数据包括：
    获取所述用户设备返回的关于所述目标应用的应用访问数据；
    其中，所述基于对应的事件描述信息对所述应用访问数据进行处理，以确定关于所述目标应用的应用访问事件的事件特征信息包括：
    基于所述事件描述信息对所述应用访问数据进行处理，以确定关于所述目标应用的应用访问事件的事件特征信息。
  9. 根据权利要求1至8中任一项所述的方法，其中，所述基于对应的事件描述信 息对所述应用访问数据进行处理，以确定关于所述目标应用的应用访问事件的事件特征信息包括：
    基于所述事件描述信息对所述应用访问数据进行日志分析，以获得关于所述目标应用的一个或多个应用访问事件；
    对所述一个或多个应用访问事件进行统计处理以获得对应的事件特征信息。
  10. 根据权利要求9所述的方法，其中，所述事件描述信息包括对应事件的运算符信息；
    其中，所述对所述一个或多个应用访问事件进行统计处理以获得对应的事件特征信息包括：
    基于所述应用访问事件所对应的所述运算符信息，对所述一个或多个应用访问事件进行统计处理以获得对应的事件特征信息。
  11. 一种在用户设备端用于处理应用访问数据的方法，其中，所述方法包括：
    获取对应网络设备提供的关于用户设备上的目标应用的事件描述信息；
    基于所述事件描述信息设置关于所述目标应用的应用访问数据的采集触发条件；
    基于所述采集触发条件采集所述应用访问数据；
    将所述应用访问数据发送至所述网络设备。
  12. 一种用于处理应用访问数据的网络设备，其中，所述网络设备包括：
    第一装置，用于获取关于对应用户设备中目标应用的应用访问数据；
    第二装置，用于基于对应的事件描述信息对所述应用访问数据进行处理，以确定关于所述目标应用的应用访问事件的事件特征信息。
  13. 根据权利要求12所述的网络设备，其中，所述网络设备还包括：
    第三装置，用于基于所述事件特征信息生成对应的图示信息，并显示所述图示信息。
  14. 根据权利要求12或13所述的网络设备，其中，所述网络设备还包括：
    第四装置，用于基于所述事件特征信息识别所述应用访问数据对应的访问者。
  15. 根据权利要求14所述的网络设备，其中，所述第四装置用于：
    基于所述事件特征信息，通过分类算法对应用访问数据对应的访问者进行识别。
  16. 根据权利要求14所述的网络设备，其中，所述第四装置用于：
    基于所述事件特征信息，通过聚类算法对应用访问数据对应的访问者进行识别。
  17. 根据权利要求14至16中任一项所述的网络设备，其中所述网络设备还包括：
    第五装置，用于基于预置的访问者可信度指标，并结合所述访问者对应的识别结果， 确定所述访问者的可信度信息。
  18. 根据权利要求17所述的网络设备，其中，所述网络设备还包括：
    第六装置，用于基于所述访问者的可信度信息，对所述目标应用进行访问控制。
  19. 根据权利要求12至18中任一项所述的网络设备，其中，所述网络设备还包括：
    第七装置，用于获取目标应用对应的事件描述信息；
    第八装置，用于将所述事件描述信息提供至安装所述目标应用的对应用户设备；
    其中，所述第一装置用于：
    获取所述用户设备返回的关于所述目标应用的应用访问数据；
    其中，所述第二装置用于：
    基于所述事件描述信息对所述应用访问数据进行处理，以确定关于所述目标应用的应用访问事件的事件特征信息。
  20. 根据权利要求12至19中任一项所述的网络设备，其中，所述第二装置包括：
    第一单元，用于基于所述事件描述信息对所述应用访问数据进行日志分析，以获得关于所述目标应用的一个或多个应用访问事件；
    第二单元，用于对所述一个或多个应用访问事件进行统计处理以获得对应的事件特征信息。
  21. 根据权利要求20所述的网络设备，其中，所述事件描述信息包括对应事件的运算符信息；
    其中，所述第二单元用于：
    基于所述应用访问事件所对应的所述运算符信息，对所述一个或多个应用访问事件进行统计处理以获得对应的事件特征信息。
  22. 一种用于处理应用访问数据的用户设备，其中，所述用户设备包括：
    第九装置，用于获取对应网络设备提供的关于用户设备上的目标应用的事件描述信息；
    第十装置，用于基于所述事件描述信息设置关于所述目标应用的应用访问数据的采集触发条件；
    第十一装置，用于基于所述采集触发条件采集所述应用访问数据；
    第十二装置，用于将所述应用访问数据发送至所述网络设备。
  23. 一种用于处理应用访问数据的***，其中，所述***包括如权利要求12至21中任一项所述的网络设备，以及如权利要求22所述的用户设备。
PCT/CN2016/082161 2015-05-22 2016-05-16 一种用于处理应用访问数据的方法与设备 WO2016188334A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510266206.3A CN106294406B (zh) 2015-05-22 2015-05-22 一种用于处理应用访问数据的方法与设备
CN201510266206.3 2015-05-22

Publications (1)

Publication Number Publication Date
WO2016188334A1 true WO2016188334A1 (zh) 2016-12-01

Family

ID=57393746

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/082161 WO2016188334A1 (zh) 2015-05-22 2016-05-16 一种用于处理应用访问数据的方法与设备

Country Status (2)

Country Link
CN (1) CN106294406B (zh)
WO (1) WO2016188334A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109684583A (zh) * 2018-11-12 2019-04-26 深圳壹账通智能科技有限公司 页面用户行为的分析方法、装置、终端及可读存储介质
CN109800123A (zh) * 2018-12-14 2019-05-24 深圳壹账通智能科技有限公司 自动化电量测试方法、装置、计算机设备及存储介质
CN111241453A (zh) * 2020-01-20 2020-06-05 平安科技（深圳）有限公司 页面访问时长采集方法、装置、介质及电子设备

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111435377B (zh) * 2019-01-11 2023-09-22 腾讯科技（深圳）有限公司 应用推荐方法、装置、电子设备以及存储介质
CN113328976B (zh) * 2020-02-28 2022-11-22 华为技术有限公司 一种安全威胁事件识别方法、装置及设备

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103023687A (zh) * 2012-05-31 2013-04-03 珠海市君天电子科技有限公司 一种关联于访问请求的统计方法及装置
US20140033094A1 (en) * 2012-07-25 2014-01-30 Oracle International Corporation Heuristic caching to personalize applications
CN103944722A (zh) * 2014-04-17 2014-07-23 华北科技学院 一种互联网环境下用户可信行为的识别方法
CN104036037A (zh) * 2014-06-30 2014-09-10 小米科技有限责任公司 处理垃圾用户的方法及装置
CN104318138A (zh) * 2014-09-30 2015-01-28 杭州同盾科技有限公司 一种验证用户身份的方法和装置

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN100590603C (zh) * 2008-08-12 2010-02-17 杭州华三通信技术有限公司 一种处理日志文件的方法及装置
CN103605738B (zh) * 2013-11-19 2017-03-15 北京国双科技有限公司 网页访问数据统计方法及装置
CN103778244A (zh) * 2014-02-11 2014-05-07 五八同城信息技术有限公司 一种基于用户行为日志的自动化报表分析方法
CN104065657A (zh) * 2014-06-26 2014-09-24 北京思特奇信息技术股份有限公司 一种基于ip访问的动态控制用户行为的方法及***
CN104158838B (zh) * 2014-07-07 2017-12-26 深信服网络科技（深圳）有限公司 信息推送的方法及装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103023687A (zh) * 2012-05-31 2013-04-03 珠海市君天电子科技有限公司 一种关联于访问请求的统计方法及装置
US20140033094A1 (en) * 2012-07-25 2014-01-30 Oracle International Corporation Heuristic caching to personalize applications
CN103944722A (zh) * 2014-04-17 2014-07-23 华北科技学院 一种互联网环境下用户可信行为的识别方法
CN104036037A (zh) * 2014-06-30 2014-09-10 小米科技有限责任公司 处理垃圾用户的方法及装置
CN104318138A (zh) * 2014-09-30 2015-01-28 杭州同盾科技有限公司 一种验证用户身份的方法和装置

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109684583A (zh) * 2018-11-12 2019-04-26 深圳壹账通智能科技有限公司 页面用户行为的分析方法、装置、终端及可读存储介质
CN109800123A (zh) * 2018-12-14 2019-05-24 深圳壹账通智能科技有限公司 自动化电量测试方法、装置、计算机设备及存储介质
CN111241453A (zh) * 2020-01-20 2020-06-05 平安科技（深圳）有限公司 页面访问时长采集方法、装置、介质及电子设备
CN111241453B (zh) * 2020-01-20 2023-09-08 平安科技（深圳）有限公司 页面访问时长采集方法、装置、介质及电子设备

Also Published As

Publication number Publication date
CN106294406A (zh) 2017-01-04
CN106294406B (zh) 2020-04-17

Similar Documents

Publication Publication Date Title
US10841323B2 (en) Detecting robotic internet activity across domains utilizing one-class and domain adaptation machine-learning models
US11586972B2 (en) Tool-specific alerting rules based on abnormal and normal patterns obtained from history logs
CN106992994B (zh) 一种云服务的自动化监控方法和***
US11102225B2 (en) Detecting fraud by correlating user behavior biometrics with other data sources
US10715570B1 (en) Generic event stream processing for machine learning
US20160269423A1 (en) Methods and systems for malware analysis
CN108460582B (zh) 制度信息处理方法、装置、计算机设备和存储介质
US20190058719A1 (en) System and a method for detecting anomalous activities in a blockchain network
US10748165B2 (en) Collecting and analyzing electronic survey responses including user-composed text
WO2016188334A1 (zh) 一种用于处理应用访问数据的方法与设备
CN112567367A (zh) 用于聚类和加速多个事故调查的基于相似性的方法
CN107193974B (zh) 基于人工智能的地域性信息确定方法和装置
CN112667825B (zh) 基于知识图谱的智能推荐方法、装置、设备及存储介质
CN107862425B (zh) 风控数据采集方法、设备、***及可读存储介质
US20170300582A1 (en) Event identification through analysis of social-media postings
WO2019153589A1 (zh) 消息数据处理方法、装置、计算机设备和存储介质
US9177319B1 (en) Ontology based customer support techniques
CN111401976B (zh) 一种异常行为检测方法、装置、设备及存储介质
CN113961764A (zh) 诈骗电话的识别方法、装置、设备及存储介质
CN111586695A (zh) 短信识别方法及相关设备
US20230050546A1 (en) Improving data integrity with trusted code attestation tokens
CN111127057B (zh) 一种多维用户画像恢复方法
TWI680666B (zh) 網路使用者身份辨識方法與系統
CN113191137A (zh) 一种操作风险获取方法、***、电子设备及存储介质
US10296990B2 (en) Verifying compliance of a land parcel to an approved usage

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16799223

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16799223

Country of ref document: EP

Kind code of ref document: A1