CN114662034A - User marking method, user marking system, electronic device and storage medium - Google Patents

Abstract

The embodiment of the application discloses a user marking method, a user marking system, electronic equipment and a storage medium, which can completely and accurately mark a user accessing a website in a cloud protection system. The method of the embodiment of the application can comprise the following steps: acquiring user data of a target user from a user information system, and determining a first label set according to the user data, wherein the first label set comprises at least one first label corresponding to the user data; acquiring network access log data corresponding to the target user from a cloud protection system; analyzing the network access log data based on a preset rule, and determining a second label set according to an analysis result, wherein the second label set comprises at least one second label corresponding to the analysis result; and determining a target label set corresponding to the target user according to the first label set and the second label set, wherein the labels under the target label set are used for marking the target user.

Description

User marking method, user marking system, electronic device and storage medium

technical field

The present application relates to the field of computer technology, and in particular, to a user marking method, a user marking system, an electronic device and a storage medium.

Background technique

The cloud protection system can provide security protection for users' website access. When users visit websites in the cloud protection system, users can be marked to provide users with differentiated and refined protection services. At present, the way of marking users who visit the website in the cloud protection system is relatively simple, resulting in a one-sided and inaccurate user marking.

SUMMARY OF THE INVENTION

The embodiments of the present application provide a user marking method, a user marking system, an electronic device, and a storage medium, which can completely and accurately mark a user who accesses a website in a cloud protection system.

A first aspect of the embodiments of the present application provides a user marking method, which may include:

Obtain user data of the target user from the user information system, and determine a first tag set according to the user data, where the first tag set includes at least one first tag corresponding to the user data;

Obtain the network access log data corresponding to the target user from the cloud protection system;

Analyze the network access log data based on a preset rule, and determine a second label set according to the analysis result, where the second label set includes at least one second label corresponding to the analysis result;

According to the first label set and the second label set, a target label set corresponding to the target user is determined, and the labels under the target label set are used to mark the target user.

Optionally, determining the first label set according to the user data includes: extracting information from the user data using named entity recognition NER technology, obtaining entity information corresponding to the target user, and determining the first label according to the entity information. Wherein, the entity information includes regional information; the determining of the first label set according to the entity information includes: determining the regional information as the first label under the first label set; and/or, the entity information includes an institution name information; determining the first label set according to the entity information includes: acquiring an industry type corresponding to the institution name information, and determining the industry type as a first label under the first label set.

Optionally, acquiring the industry type corresponding to the institution name information, and determining the industry type as the first label under the first label set, includes: determining the industry type corresponding to the institution name information based on a preset industry division rule. the target industry type, the preset industry division rule includes the industry type corresponding to a plurality of organization name information; the target industry type is determined as the first label under the first label set.

Optionally, analyzing the network access log data based on a preset rule, and determining the second label set according to the analysis result, includes: analyzing the network access log data, and obtaining analysis data, where the analysis data includes and the target. At least one of the website address corresponding to the user, the network resource information corresponding to the requesting uniform resource locator URL, the target URL, and the summary information of the website's historical access; based on the preset rules, determine the data type corresponding to the analysis data, and A second set of tags is determined according to the data type.

Optionally, the analysis data includes the website address corresponding to the target user; the data type corresponding to the analysis data is determined based on a preset rule, and the second label set is determined according to the data type, including: the website The address is resolved to determine the root domain name corresponding to the website address; the target domain name type corresponding to the root domain name is determined based on the preset first classification rule, and the preset first classification rule includes multiple domain name types; The target domain name type is determined as the second label under the second label set.

Optionally, the analysis data includes the network resource information corresponding to the request URL; the data type corresponding to the analysis data is determined based on a preset rule, and the second label set is determined according to the data type, including: obtaining the The webpage service corresponding to the resource type to which the network resource information belongs and the first characteristic information of the webpage service; the first characteristic information is matched with the characteristic information of the preset multiple webpage services; The target resource type corresponding to the target feature information, the first target feature information is the feature information that is successfully matched with the first feature information in the feature information of the plurality of webpage services; the target resource type is determined as the second tag set. Second tab.

Optionally, the analysis data includes the target URL; the data type corresponding to the analysis data is determined based on a preset rule, and the second label set is determined according to the data type, including: acquiring the second feature information of the target URL ; This second feature information is matched with the feature information of the preset multiple URLs; If the matching is successful, then determine the URL type corresponding to the second target feature information, and the second target feature information is the feature of the multiple URLs The feature information in the information that is successfully matched with the second feature information; the URL type is determined as the second tag under the second tag set.

Optionally, the analysis data includes historical access summary information of the website; the data type corresponding to the analysis data is determined based on a preset rule, and the second label set is determined according to the data type, including: in the historical access summary In the information, the first visit summary information within a preset time period is obtained, and the first visit summary information includes the number of visits to the website by the target user; the number of visits at each moment in the preset time period is clustered to obtain The access curve corresponding to the preset time period, the access curve is used to reflect the number of visits of the target user to the website at each moment; the third characteristic information of the access curve corresponds to the preset multiple access curves respectively The feature information is matched; if the matching is successful, the target label corresponding to the third target feature information is determined, and the third target feature information is the feature that is successfully matched with the third feature information in the feature information corresponding to the multiple access curves respectively. information; determine the target tag as the second tag under the second tag set.

A second aspect of the embodiments of the present application provides a user marking system, which may include:

a first data acquisition module, used for acquiring user data of the target user from the user information system;

a first data processing module, configured to determine a first tag set according to the user data, where the first tag set includes at least one first tag corresponding to the user data;

The second data collection module is used to obtain the network access log data corresponding to the target user from the cloud protection system;

a second data processing module, configured to analyze the network access log data based on a preset rule, and determine a second label set according to the analysis result, where the second label set includes at least one second label corresponding to the analysis result;

A user marking module, configured to determine a target label set corresponding to the target user according to the first label set and the second label set, and the labels under the target label set are used to mark the target user.

Optionally, the first data processing module is specifically configured to use named entity recognition NER technology to perform information extraction on the user data, obtain entity information corresponding to the target user, and determine the first label set according to the entity information; wherein, The entity information includes region information, and the region information is determined as the first label under the first label set; and/or, the entity information includes organization name information, obtains the industry type corresponding to the organization name information, and assigns the industry The type is determined as the first label under the first label set.

Optionally, the first data processing module is specifically configured to determine the target industry type corresponding to the institution name information based on a preset industry division rule, and the preset industry division rule includes the industry types corresponding to the multiple institution name information. ; Determine the target industry type as the first label under the first label set.

Optionally, the second data processing module is specifically configured to analyze the network access log data to obtain analysis data, where the analysis data includes the website address corresponding to the target user and the network resource corresponding to the requesting uniform resource locator URL. at least one of information, target URL, and summary information of historical visits of the website; based on preset rules, determine the data type corresponding to the analysis data, and determine the second tag set according to the data type.

Optionally, the second data processing module is specifically used for the analysis data to include the website address corresponding to the target user; to analyze the website address to determine the root domain name corresponding to the website address; based on the preset first The classification rule determines the target domain name type corresponding to the root domain name, the preset first classification rule includes multiple domain name types; the target domain name type is determined as the second label under the second label set.

Optionally, the second data processing module is specifically used for the analysis data to include the network resource information corresponding to the request URL; to obtain the webpage service corresponding to the resource type to which the network resource information belongs and the first feature information of the webpage service. ; The first feature information is matched with the feature information of the preset multiple webpage services; if the matching is successful, the target resource type corresponding to the first target feature information is determined, and the first target feature information is the multiple webpages The feature information in the feature information of the service that is successfully matched with the first feature information; the target resource type is determined as the second tag under the second tag set.

Optionally, the second data processing module is specifically used for the analysis data to include the target URL; obtain the second feature information of the target URL; match the second feature information with the feature information of multiple preset URLs; If the matching is successful, the URL type corresponding to the second target feature information is determined, and the second target feature information is the feature information that is successfully matched with the second feature information in the feature information of the multiple URLs; the URL type is determined as The second label under the second label set.

Optionally, the second data processing module is specifically used for the analysis data to include historical visit summary information of the website; in the historical visit summary information, obtain first visit summary information within a preset time period, the first visit The summary information includes the number of visits of the target user to the website; the number of visits at each moment in the preset time period is clustered to obtain an access curve corresponding to the preset time period, and the access curve is used to reflect the target user's The number of visits to the website at each moment; the third feature information of the access curve is matched with the feature information corresponding to the preset multiple access curves; if the matching is successful, the target corresponding to the third target feature information is determined label, the third target feature information is the feature information that is successfully matched with the third feature information among the feature information corresponding to the multiple access curves respectively; the target label is determined as the second label under the second label set.

A third aspect of the embodiments of the present application provides an electronic device, which may include:

a memory in which executable program code is stored;

and the memory-coupled processor;

The processor invokes the executable program code stored in the memory, and when the executable program code is executed by the processor, causes the processor to implement the method according to the first aspect of the embodiments of the present application .

A fourth aspect of the embodiments of the present application provides a computer-readable storage medium on which executable program codes are stored, and when the executable program codes are executed by a processor, implement the method described in the first aspect of the embodiments of the present application .

A fifth aspect of the embodiments of the present application discloses a computer program product that, when the computer program product runs on a computer, causes the computer to execute any one of the methods disclosed in the first aspect of the embodiments of the present application.

A sixth aspect of the embodiments of the present application discloses an application publishing platform, and the application publishing platform is used to publish a computer program product, wherein when the computer program product runs on a computer, the computer is caused to execute the first aspect of the embodiments of the present application. any of the methods described.

As can be seen from the above technical solutions, the embodiments of the present application have the following advantages:

In the embodiment of the present application, the electronic device obtains the user data of the target user from the user information system, and determines a first tag set according to the user data, where the first tag set includes at least one first tag corresponding to the user data, The first tag under the first tag set can be used to mark the real situation of the target user in the user information system; the electronic device obtains the network access log data corresponding to the target user from the cloud protection system; then, the electronic device The network access log data is analyzed based on preset rules, and a second tag set is determined according to the analysis result. The second tag set includes at least one second tag corresponding to the analysis result. The second tag set under the second tag set All tags can be used to mark the online record information of the target user in the cloud protection system; finally, the electronic device determines the target tag set corresponding to the target user according to the first tag set and the second tag set, which can be combined with User data and network access log data mark target users at the same time, which makes user marks more diverse and complete, and can mark users who visit websites in the cloud protection system completely and accurately.

Description of drawings

In order to illustrate the technical solutions of the embodiments of the present application more clearly, the following will briefly introduce the accompanying drawings that need to be used in the description of the embodiments and the prior art. Obviously, the drawings in the following description are only some implementations of the present application. For example, other drawings may also be obtained from these drawings.

FIG. 1 is a schematic diagram of a scenario of a user marking method in an embodiment of the present application;

FIG. 2 is a schematic diagram of an embodiment of a user marking method in an embodiment of the present application;

FIG. 3 is a schematic diagram of another embodiment of a user marking method in an embodiment of the present application;

FIG. 4 is a schematic diagram of an embodiment of a user marking system in an embodiment of the present application;

FIG. 5 is a schematic diagram of an embodiment of an electronic device in an embodiment of the present application.

Detailed ways

The embodiments of the present application provide a user marking method, a user marking system, an electronic device, and a storage medium, which can completely and accurately mark a user who accesses a website in a cloud protection system.

In order to make those skilled in the art better understand the solutions of the present application, the technical solutions in the embodiments of the present application will be described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the present application. examples, but not all examples. Based on the embodiments in this application, all should belong to the scope of protection of this application.

It should be noted that the execution body of the embodiment of the present application may be a user marking system or an electronic device, and the electronic device may include but is not limited to a server. The technical solution of the present application will be further described below by taking the user marking system as an example.

In some embodiments, as shown in FIG. 1 , it is a schematic diagram of a scenario of a user marking method in an embodiment of the present application. In FIG. 1, when the user terminal 101 accesses the website in the cloud protection system of the server 102, user data of at least one user and network access log data of at least one user are generated; the user information system of the server 102 can store the user data, the The cloud protection system may store the network access log data.

The server 102 can obtain the user data of the target user from the user information system, and determine the first tag set according to the user data; the server 102 can obtain the network access log data of the target user from the cloud protection system, and according to the user data The network access log data determines a second tag set; finally, the server 102 determines a target tag set corresponding to the target user according to the first tag set and the second tag set.

As shown in FIG. 2, it is a schematic diagram of an embodiment of a user marking method in this embodiment of the present application, which may include:

201. Acquire user data of a target user from a user information system.

In some embodiments, the user information system may store user data of at least one user whose user terminal accesses the website in the cloud protection system. Optionally, the number of user data of each user may be at least one, and when the number of user data of the first user is multiple, the multiple user data are different, wherein the first user is each of the above. any of the users.

Optionally, the user data of the first user may include, but is not limited to, at least one of the following: the first user's login account, login password, user name, location information, work information, and the like.

In some embodiments, the target user refers to any one of the at least one user, that is, each user of the at least one user may be a target user. That is, in the user information system, the electronic device can obtain the user data of the target user from the user data of the at least one user, so that the electronic device can process the user data of the target user more accurately in the future.

202. Determine a first tag set according to user data.

Wherein, the first tag set includes at least one first tag corresponding to the user data.

In some embodiments, since the number of user data of the target user is at least one, and each user data may correspond to a first tag, the electronic device may determine, according to the at least one user data, that it corresponds to the at least one user data respectively at least one first label of the target user, and determine a first label set corresponding to the target user according to the at least one first label.

Wherein, each first label under the first label set can be used to mark the real situation of the target user in the user information system.

In some embodiments, the electronic device determining the first tag set according to the user data may include: the electronic device may first analyze the user data to obtain entity information; the electronic device then uses the entity information to determine the first tag set.

Optionally, the entity information may include regional information and/or organization name information.

The electronic device can analyze the location information of the target user, determine the regional information corresponding to the location information, and/or analyze the work information of the target user, and determine the organization name information corresponding to the work information; then, The electronic device can then accurately determine the first label corresponding to the region information and/or the organization name information according to the region information and/or the organization name information, and determine the first label corresponding to the target user according to the first label. A collection of labels.

203. Obtain network access log data corresponding to the target user from the cloud protection system.

In some embodiments, when detecting that the user terminal uses the cloud protection system, the cloud protection system may record the request data when the user terminal accesses at least one website in the cloud protection system, and obtain the data corresponding to the user of the user terminal. of network access log data.

The network access log data refers to a Hyper Text Transfer Protocol (Hyper Text Transfer Protocol, HTTP) log corresponding to when the user terminal accesses at least one website in the cloud protection system.

Optionally, the request data may include but not limited to at least one of the following: request time, request method, request uniform resource locator (Uniform Resource Locator, URL), and the like.

Optionally, the number of user terminals using the cloud protection system may be at least one, that is, when the cloud protection system detects that at least one user terminal uses the cloud protection system, it may store information about the user terminal of the at least one user terminal. Corresponding network access log data. Wherein, when the cloud protection system detects that multiple user terminals use the cloud protection system, the network access log data stored by the cloud protection system and corresponding to the users of the multiple user terminals may be the same or different. , there is no specific limitation here.

That is to say, the electronic device in the cloud protection system can obtain the network access log data corresponding to the target user from the network access log data corresponding to the user of the at least one user terminal, so that the electronic device can more accurately The network access log data corresponding to the target user is processed.

204. Analyze the network access log data based on a preset rule, and determine a second tag set according to the analysis result.

Wherein, the second label set includes at least one second label corresponding to the analysis result.

In some embodiments, the electronic device analyzes the acquired network access log data based on a preset rule to obtain at least one analysis result; the electronic device may determine the corresponding at least one analysis result according to the at least one analysis result. at least one second tag; then, the electronic device determines a second tag set corresponding to the target user according to the at least one second tag.

Wherein, each second label under the second label set can be used to mark the Internet record information of the target user in the cloud protection system.

In some embodiments, the electronic device analyzes the acquired network access log data to obtain at least one analysis data corresponding to the network access log data, and then the electronic device determines the at least one analysis data based on the preset rule At least one data type corresponding to the data, and finally, the electronic device determines a second tag set corresponding to the target user according to the at least one data type.

The preset rule refers to a rule preset in the electronic device for analyzing network access log data.

Optionally, the above-mentioned analysis data may include but not limited to at least one of the following: the website address (abbreviated as: website) corresponding to the target user, the web resource information corresponding to the request URL, the target URL and the historical access summary information of the website, etc. .

The URL corresponding to the target user refers to URL address path information corresponding to the website that the target user has visited in the cloud protection system through the user terminal.

The network resource information corresponding to the request URL refers to the data resource corresponding to the request URL generated by the target user accessing the website through the user terminal when using the cloud protection system. Among them, the data resources can be divided into static web resources and dynamic web resources. The static web resources refer to the data in the web pages corresponding to the website for the target user to browse, and the dynamic web resources refer to the data on the website. The data in the corresponding web page for the target user to browse is generated by a program, and different users or different time points visit the web page to see different contents. Optionally, the static web resource may include, but is not limited to, at least one of the following: Hyper Text Markup Language (HTML), Cascading Style Sheets (CSS), literal translation scripting language (JavaScript, JS) , text document format (Text, TXT), audio, video and pictures, etc.; the dynamic web resources may include but not limited to at least one of the following: dynamic web page technology standard (Java Server Pages, JSP) pages, Servlet programs and Thymeleaf programs, etc.

The target URL refers to the situation that the target user requests at least one URL when using the cloud protection system through the user terminal, and the electronic device can use the URL whose number of requests is greater than the preset number of times as the target URL, where the preset number of times can be It is set by the electronic device before leaving the factory, or it can be customized by the target user, which is not specifically limited here.

The aggregated information on historical visits to a website may include, but is not limited to, at least one of the following: the visit time, the content of the visit, and the number of visits to the website within a preset period of time, etc., when the target user visits the website, and the like. The set time period may be set before the electronic device leaves the factory, or may be defined by the target user, which is not specifically limited here.

It should be noted that the sequence of steps 201-202 and steps 203-204 is not limited.

205. Determine a target label set corresponding to the target user according to the first label set and the second label set.

The tags under the target tag set are used to mark the target user.

In some embodiments, since the first tag under the first tag set is used to mark the real situation of the target user in the user information system, the second tag under the second tag set is used to mark the target user in the cloud protection system Therefore, the target tag set corresponding to the target user obtained by the electronic device according to the first tag set and the second tag set is relatively complete. In this way, the electronic device can more accurately mark the target user according to the relatively complete set of target tags, so that the cloud protection system can subsequently provide the target user with more precise information based on the relatively complete set of target tags. Serve.

In some embodiments, after acquiring the first label set and the second label set, the electronic device may perform deduplication processing on the first label under the first label set and the second label under the second label set to obtain The target tag set corresponding to the target user; or, the electronic device may obtain part of the first tag under the first tag set and part of the second tag under the second tag set, and use the part of the first tag and part of the second tag. Two tags are formed to obtain a target tag set corresponding to the target user. The target tag set obtained by either method can more accurately mark the target user.

In the embodiment of the present application, the electronic device obtains the user data of the target user from the user information system, and determines a first tag set according to the user data, where the first tag set includes at least one first tag corresponding to the user data, The first tag under the first tag set can be used to mark the real situation of the target user in the user information system; the electronic device obtains the network access log data corresponding to the target user from the cloud protection system; then, the electronic device The network access log data is analyzed based on preset rules, and a second tag set is determined according to the analysis result. The second tag set includes at least one second tag corresponding to the analysis result. The second tag set under the second tag set All tags can be used to mark the online record information of the target user in the cloud protection system; finally, the electronic device determines the target tag set corresponding to the target user according to the first tag set and the second tag set, which can be combined with User data and network access log data mark target users at the same time, making user marks more diverse. The electronic device can mark users who visit websites in the cloud protection system completely and accurately by using the labels under the target label set. .

As shown in FIG. 3, it is a schematic diagram of another embodiment of the user marking method in this embodiment of the present application, which may include:

301. Obtain user data of a target user from a user information system.

It should be noted that step 301 is similar to step 201 shown in FIG. 2 in this embodiment, and details are not repeated here.

302. Use the named entity recognition NER technology to extract information from the user data to obtain entity information corresponding to the target user.

It can be understood that the named entity recognition (Named Entity Recognition, NER) technology, also called proper name recognition technology, is a common data processing technology in natural language processing, and is widely used. Named entities usually refer to unstructured user data with special meaning or highly referential entity information, the entity information may include but not limited to at least one of the following: user name information, geographical information, organization name information, time information, proper noun information, etc.

In some embodiments, the electronic device can use the NER technology to perform information extraction on the user data of the target user, and obtain the entity information corresponding to the target user accurately, so that the electronic device can perform effective and accurate follow-up on the entity information. deal with. The entity information may include, but is not limited to, geographic information and/or organization name information.

303. Determine a first tag set according to the entity information.

In some embodiments, after acquiring the entity information corresponding to the target user, the electronic device may determine a first tag corresponding to the entity information according to the entity information, and form the first tag into a first tag set to Mark the real situation of this target user.

Optionally, the electronic device determines the first tag set according to the entity information, which may include, but is not limited to, at least one of the following implementations:

Implementation 1: the entity information includes regional information; the electronic device determines the regional information as the first tag under the first tag set.

In some embodiments, since the region information can directly mark the target user, the electronic device can directly determine the region information as the first tag under the first tag set to mark the target user.

Implementation mode 2: the entity information includes organization name information; the electronic device acquires the industry type corresponding to the organization name information, and determines the industry type as the first label under the first label set.

Optionally, the electronic device obtains the industry type corresponding to the name information of the institution, and determines the industry type as the first label under the first label set, including: the electronic device determines, based on the preset industry division rules, the industry type that is related to the institution. The target industry type corresponding to the name information; the electronic device determines the target industry type as the first label under the first label set.

Wherein, the preset industry division rule may include industry types corresponding to multiple organization name information.

Because the organization name information cannot reflect the relevant characteristics of the target user, that is, the organization name information cannot directly mark the target user effectively, and the industry type corresponding to the organization name information can effectively reflect the relevant characteristics of the target user, that is, the relevant characteristics of the target user can be effectively reflected by the organization name information The industry type corresponding to the organization name information can effectively mark the target user. In addition, the electronic device stores multiple industry types corresponding to the organization name information, that is, the electronic device stores preset industry division rules. Therefore, this The electronic device can first obtain the industry type corresponding to the organization name information in the preset industry classification rules, and then the electronic device determines the industry type corresponding to the organization name information as the first label set under the first label set. tags to ensure that the target user can be effectively tagged.

Optionally, the industry types preset in the electronic device may include, but are not limited to, at least one of the following: insurance industry, catering industry, telecommunication industry, real estate, service industry, clothing industry, and advertising industry.

Optionally, the electronic device determines the target industry type corresponding to the name information of the institution based on the preset industry division rules, which may include: the electronic device uses a Bayesian classifier to determine the target industry type based on the preset industry division rules. The target industry type corresponding to the name information.

Among them, the Bayesian classifier refers to the prior probability of the name information of the organization, and the posterior probability of the name information of the organization is calculated by the Bayesian formula, that is, the probability that the name information of the organization belongs to a certain industry type, select The industry type corresponding to the largest posterior probability is used as the target industry type corresponding to the institution name information.

Using the Bayesian classifier, the electronic device can accurately classify the organization name information, and obtain the target industry type corresponding to the organization name information.

304. Obtain network access log data corresponding to the target user from the cloud protection system.

It should be noted that step 304 is similar to step 203 shown in FIG. 2 in this embodiment, and details are not repeated here.

305. Analyze the network access log data to obtain analysis data.

In some embodiments, the electronic device analyzes the network access log data to obtain the analysis data, so that the subsequent electronic device can process the analysis data.

Optionally, the electronic device analyzes the network access log data to obtain the analysis data, which may include, but is not limited to, at least one of the following implementations:

Implementation mode 1: The electronic device analyzes the network access log data, and obtains the URL address path information corresponding to the website that the target user has visited in the cloud protection system through the user terminal; the electronic device uses the URL address path information as the target user. The website address corresponding to the user.

In some embodiments, the electronic device can analyze the network access log data to determine the website that the target user has used in the cloud protection system; then, the electronic device can obtain the website address bar corresponding to the used website URL address path information; then, the electronic device can directly use the URL address path information as the website address corresponding to the target user.

Implementation mode 2: The electronic device analyzes the network access log data, and obtains the request data generated by the target user accessing the network through the user terminal when using the cloud protection system, and the request data is the request URL; then, the electronic device can be based on the request URL. , the data resource corresponding to the request URL can be determined; then, the electronic device uses the data resource as the network resource information corresponding to the request URL.

Implementation 3: The electronic device analyzes the network access log data, and obtains at least one request URL generated by the target user through the user terminal when using the cloud protection system; the electronic device obtains the number of requests corresponding to the at least one request URL; then, the The electronic device may obtain a URL whose number of requests is greater than a preset number of times, and use the URL as a target URL.

Implementation mode 4: The electronic device analyzes the network access log data, obtains the website used by the target user in the cloud protection system through the user terminal, and obtains the historical visit summary information of the website. Wherein, the historical visit summary information of the website may include, but is not limited to, at least one of the following: visit time, visit content, and visit times of the website within a preset time period when the target user uses the website.

The electronic device can effectively process the website address and URL corresponding to the target user, the network resource information corresponding to the request URL, the target URL, and the website's historical access summary information obtained from implementations 1 to 4, respectively.

306. Based on a preset rule, determine a data type corresponding to the analysis data, and determine a second tag set according to the data type.

In some embodiments, since the analysis data cannot reflect the relevant characteristics of the target user, that is, the analysis data cannot effectively mark the target user, and the data type corresponding to the analysis data can effectively reflect the relevant characteristics of the target user, that is, the above-mentioned The data type corresponding to the analysis data can effectively mark the target user. Therefore, after acquiring the analysis data, the electronic device can first determine the data type corresponding to the analysis data from the preset multiple data types, and then, The electronic device can effectively determine the second tag set according to the data type, so as to effectively tag the target user.

Optionally, the electronic device determines a data type corresponding to the analysis data based on a preset rule, and determines a second tag set according to the data type, which may include, but is not limited to, at least one of the following implementations:

Implementation mode 1: the analysis data includes the website address corresponding to the target user; the electronic device parses the website address to determine the root domain name corresponding to the website address; the electronic device determines based on the preset first classification rule The target domain name type corresponding to the root domain name, the preset first classification rule includes multiple domain name types; the electronic device determines the target domain name type as the second label under the second label set.

In some embodiments, the website address may include, but is not limited to, the root domain name of the website, the website program, and the website space. After obtaining the website address, the electronic device can parse the website address to obtain the root domain name corresponding to the website address; then, the electronic device can determine the target corresponding to the root domain name from the preset multiple domain name types domain name type, and the target domain name type is determined as the second label under the second label set.

Optionally, the electronic device determines the target domain name type corresponding to the root domain name based on the preset first classification rule, which may include: the electronic device uses a Bayesian classifier to determine, based on the preset first classification rule, the target domain name type corresponding to the root domain name. The target domain name type corresponding to the root domain name.

The electronic device can accurately classify the root domain name by using the Bayesian classifier, and obtain the target domain name type corresponding to the root domain name.

Implementation 2: the analysis data includes the network resource information corresponding to the request URL; the electronic device obtains the web page service corresponding to the resource type to which the network resource information belongs and the first feature information of the web page service; the electronic device obtains the first feature information of the web page service; A feature information is matched with the preset feature information of multiple webpage services; if the matching is successful, the target resource type corresponding to the first target feature information is determined, and the first target feature information is the feature information of the multiple webpage services. The feature information that successfully matches with the first feature information in the electronic device; the electronic device determines the target resource type as the second tag under the second tag set.

In some embodiments, after acquiring the network resource information, the electronic device needs to determine whether the network resource information is a static network resource or a dynamic network resource, that is, it needs to determine the resource type to which the network resource information belongs; then, the electronic device acquires the resource The web service corresponding to the type and the first feature information of the web service, the web service refers to the client and server applications that communicate through the World Wide Web (World Wide Web, WWW) Hyper Text Transfer Protocol (Hyper Text Transfer Protocol, HTTP) program, the first feature information refers to the language development corresponding to the web page service being developed; then, if the electronic device obtains the first feature information corresponding to the language development in the preset feature information of multiple web page services target feature information, the language development type corresponding to the first target feature information, that is, the target resource type can be obtained, and the target resource type can be determined as the second label under the second label set.

Optionally, the electronic device matches the first feature information with the preset feature information of multiple web services; if the matching is successful, determining the target resource type corresponding to the first target feature information may include: the electronic device utilizes The Bayesian classifier matches the first feature information with the preset feature information of multiple webpage services; if the matching is successful, the target resource type corresponding to the first target feature information is determined.

The electronic device can accurately classify the first feature information by using the Bayesian classifier, and obtain the target resource type corresponding to the first target feature information.

Implementation 3: the analysis data includes the target URL; the electronic device obtains the second feature information of the target URL; the electronic device matches the second feature information with the preset feature information of multiple URLs; if the matching is successful, Then determine the URL type corresponding to the second target feature information, and the second target feature information is the feature information that is successfully matched with the second feature information in the feature information of the multiple URLs; the electronic device determines the URL type as the first URL type. The second label under the second label set.

In some embodiments, the feature information of the URL refers to the text feature information of the URL, and the text feature information may include, but is not limited to, lexical features and/or structural features.

Multiple lexical features and/or multiple structural features are preset in the electronic device. Among the preset multiple lexical features and/or multiple structural features, different lexical features and/or structural features correspond to a URL type. Optionally, the URL type may include, but is not limited to, at least one of the following: a directory (root) type, a secondary directory (subroot) type, a path (path) type, a file (file) type, and the like. Among them, the root type can represent the homepage of the website corresponding to the URL; the subroot type can represent the secondary column homepage of the website corresponding to the URL; the path type can represent the list page of the website corresponding to the URL, which contains rich link information; the file type can represent the corresponding URL Web pages are content pages.

After acquiring the lexical feature and/or structural feature of the target URL, the electronic device will, among the preset multiple lexical features and/or multiple structural features, obtain a lexical feature and/or structural feature corresponding to the target URL. The URL type is determined as the second tag under the second tag set.

Optionally, the electronic device matches the second feature information with the preset feature information of multiple URLs; if the matching is successful, then determining the URL type corresponding to the second target feature information, which may include: the electronic device utilizes Bayeux. The classifier matches the second feature information with the preset feature information of multiple URLs; if the matching is successful, the URL type corresponding to the second target feature information is determined.

The electronic device can accurately classify the second feature information by using the Bayesian classifier, and obtain a URL type corresponding to the second target feature information.

Implementation mode 4: the analysis data includes the historical visit summary information of the website; the electronic device obtains the first visit summary information within a preset time period from the historical visit summary information, and the first visit summary information may include but is not limited to The number of visits of the target user to the website; the electronic device clusters the number of visits at each moment in the preset time period to obtain an access curve corresponding to the preset time period, and the access curve is used to reflect the target user's The number of visits to the website at each moment; the electronic device matches the third feature information of the access curve with the feature information corresponding to a plurality of preset access curves; if the matching is successful, it is determined to match the third target feature information The corresponding target tag, the third target feature information is the feature information that is successfully matched with the third feature information in the feature information corresponding to the multiple access curves respectively; the electronic device determines the target tag as the second tag set. Second tab.

In some embodiments, preset access curves corresponding to different users are different, and labels corresponding to different preset access curves are also different.

The electronic device may obtain the first visit summary information within a preset time period after obtaining the historical visit summary information corresponding to the target user, because the first visit summary information may include the number of visits to the website by the target user, and may also include the predetermined time period. Set each moment information in the time period, so, based on the first access summary information, the electronic device performs clustering on the number of visits at each moment in the preset time period, and obtains the access curve corresponding to the preset time period. In the access curve, each time and the number of visits corresponding to each time are the characteristic information of the access curve corresponding to the target user. Since feature information corresponding to access curves corresponding to multiple users is stored in the electronic device, in the feature information corresponding to the preset multiple access curves, if the electronic device obtains all the access curves corresponding to the target user Corresponding feature information, the target label corresponding to the feature information can be directly obtained, and the target label is determined as the second label under the second label set.

It should be noted that the sequence of steps 301-303 and steps 304-306 is not limited.

307. Determine a target label set corresponding to the target user according to the first label set and the second label set.

In some embodiments, the electronic device can process the first tag set and the second tag set, and can accurately determine the target tag set corresponding to the target user.

Optionally, the electronic device determines the target tag set corresponding to the target user according to the first tag set and the second tag set, which may include but is not limited to one of the following implementations:

Implementation mode 1: The electronic device performs deduplication processing on the first tag under the first tag set and the second tag under the second tag set, to obtain a target tag set corresponding to the target user.

In some embodiments, the first label under the first label set and the second label under the second label set may have the same label, the electronic device may remove the same label from the first label, and then store the remaining label The first label of the user is combined with the second label under the second label set to obtain the target label set corresponding to the target user; or, the electronic device can remove the same label from the second label, and then use the remaining The second tag is combined with the first tag under the first tag set to obtain a target tag set corresponding to the target user. That is, the electronic device can avoid repeating the marking of the target user, so as to improve the completeness and accuracy of the marking.

Implementation 2: The electronic device obtains a first number of first labels under the first label set, and obtains a second number of second labels under the second label set; the electronic device obtains the first label according to the first number of first labels and the For the second number of second tags, a target tag set corresponding to the target user is obtained.

Optionally, the first quantity and the second quantity may be the same or different, which are not specifically limited here.

In some embodiments, since the target user can be effectively marked with the first number of first tags and the second number of second tags, the electronic device can use the first number of first tags and the second number of first tags The two tags are combined to obtain a target tag set corresponding to the target user, so as to effectively mark the target user.

Regardless of whether the target tag set is obtained in implementation mode 1 or the target tag set obtained in implementation mode 2, the target tag set is relatively complete, so that the target user can be marked comprehensively and effectively, so that the cloud protection system can follow up This target user provides services with a smaller degree of differentiation and a higher degree of granularity.

In the embodiment of the present application, the electronic device obtains the user data of the target user from the user information system; the electronic device uses the named entity recognition NER technology to extract information from the user data, and can accurately obtain the entity information corresponding to the target user, and according to the The entity information determines a first tag set, and the first tag under the first tag set can be used to mark the real situation of the target user in the user information system; then, the electronic device obtains the corresponding correspondence of the target user from the cloud protection system the network access log data; the electronic device analyzes the network access log data to obtain analysis data, determines a data type corresponding to the analysis data based on preset rules, and determines a second label set according to the data type, the second label set The second label under the cloud protection system can be used to mark the Internet record information of the target user in the cloud protection system; finally, the electronic device determines the target label corresponding to the target user according to the first label set and the second label set. Collection, which can mark target users at the same time in combination with user data and network access log data, making user marks more diverse, and the electronic device can use the tags under the target tag collection to complete the user who visits the website in the cloud protection system. and accurately marked.

As shown in FIG. 4, it is a schematic diagram of an embodiment of the user marking system in the embodiment of the present application, which may include:

The first data collection module 401 is used to obtain user data of the target user from the user information system;

a first data processing module 402, configured to determine a first tag set according to the user data, where the first tag set includes at least one first tag corresponding to the user data;

The second data collection module 403 is configured to obtain the network access log data corresponding to the target user from the cloud protection system;

The second data processing module 404 is configured to analyze the network access log data based on a preset rule, and determine a second label set according to the analysis result, where the second label set includes at least one second label corresponding to the analysis result;

The user tagging module 405 is configured to determine a target tag set corresponding to the target user according to the first tag set and the second tag set, and the tags under the target tag set are used to tag the target user.

Optionally, in some embodiments of the present application,

The first data processing module 402 is specifically used to extract information from the user data by using named entity recognition NER technology, obtain entity information corresponding to the target user, and determine a first label set according to the entity information; wherein, the entity information Including regional information, and determining the regional information as the first label under the first label set; and/or, the entity information including institution name information, obtaining the industry type corresponding to the institution name information, and determining the industry type as The first label under the first label set.

Optionally, in some embodiments of the present application,

The first data processing module 402 is specifically configured to determine the target industry type corresponding to the institution name information based on a preset industry division rule, where the preset industry division rule includes industry types corresponding to multiple institution name information; The target industry type is determined as the first label under the first label set.

Optionally, in some embodiments of the present application,

The second data processing module 404 is specifically configured to analyze the network access log data to obtain analysis data, where the analysis data includes the website address corresponding to the target user, the network resource information corresponding to the requesting uniform resource locator URL, the target At least one of URL and historical access summary information of the website; based on preset rules, determine the data type corresponding to the analysis data, and determine the second tag set according to the data type.

Optionally, in some embodiments of the present application,

The second data processing module 404 is specifically used for the analysis data including the website address corresponding to the target user; parsing the website address to determine the root domain name corresponding to the website address; based on the preset first classification rule, A target domain name type corresponding to the root domain name is determined, and the preset first classification rule includes multiple domain name types; the target domain name type is determined as a second label under the second label set.

Optionally, in some embodiments of the present application,

The second data processing module 404 is specifically configured for the analysis data to include the network resource information corresponding to the request URL; to obtain the web page service corresponding to the resource type to which the network resource information belongs and the first feature information of the web page service; The first feature information is matched with the preset feature information of multiple webpage services; if the matching is successful, the target resource type corresponding to the first target feature information is determined, and the first target feature information is the feature of the multiple webpage services. The feature information in the information that is successfully matched with the first feature information; the target resource type is determined as the second tag under the second tag set.

Optionally, in some embodiments of the present application,

The second data processing module 404 is specifically used for the analysis data to include the target URL; obtaining second feature information of the target URL; matching the second feature information with the preset feature information of multiple URLs; if the matching is successful , then determine the URL type corresponding to the second target feature information, and the second target feature information is the feature information that is successfully matched with the second feature information in the feature information of the multiple URLs; the URL type is determined as the second label Second tab under Collections.

Optionally, in some embodiments of the present application,

The second data processing module 404 is specifically configured for the analysis data to include historical visit summary information of the website; in the historical visit summary information, obtain first visit summary information within a preset time period, and the first visit summary information includes The number of visits to the website by the target user; clustering the number of visits at each moment in the preset time period to obtain an access curve corresponding to the preset time period, and the access curve is used to reflect the target user at each moment. The number of visits to the website; the third feature information of the access curve is matched with the feature information corresponding to the preset multiple access curves respectively; if the matching is successful, the target label corresponding to the third target feature information is determined, and the The third target feature information is the feature information that is successfully matched with the third feature information among the feature information corresponding to the multiple access curves respectively; the target label is determined as the second label under the second label set.

As shown in FIG. 5 , it is a schematic diagram of an embodiment of the electronic device in the embodiment of the present application. The electronic device may include: a memory 501 and a processor 502, the memory 501 and the processor 502 are coupled, and the processor 502 invokes executable program codes stored in the memory 501;

In this embodiment of the present application, the processor 502 also has the following functions:

Obtain user data of the target user from the user information system, and determine a first tag set according to the user data, where the first tag set includes at least one first tag corresponding to the user data;

Obtain the network access log data corresponding to the target user from the cloud protection system;

Analyze the network access log data based on a preset rule, and determine a second label set according to the analysis result, where the second label set includes at least one second label corresponding to the analysis result;

According to the first label set and the second label set, a target label set corresponding to the target user is determined, and the labels under the target label set are used to mark the target user.

Optionally, the processor 502 also has the following functions:

Use named entity recognition NER technology to extract information from the user data, obtain entity information corresponding to the target user, and determine the first label set according to the entity information; wherein, the entity information includes regional information, and the regional information is determined as The first label under the first label set; and/or, the entity information includes institution name information, obtain the industry type corresponding to the institution name information, and determine the industry type as the first label under the first label set.

Optionally, the processor 502 also has the following functions:

Determine the target industry type corresponding to the institution name information based on a preset industry division rule, where the preset industry division rule includes industry types corresponding to multiple institution name information; determine the target industry type as the first label set the first label.

Optionally, the processor 502 also has the following functions:

The network access log data is analyzed to obtain analysis data, and the analysis data includes the website address corresponding to the target user, the network resource information corresponding to the requesting uniform resource locator URL, the target URL and the historical access summary information of the website. At least one of: determining a data type corresponding to the analysis data based on a preset rule, and determining a second tag set according to the data type.

Optionally, the processor 502 also has the following functions:

The analysis data includes the website address corresponding to the target user; the website address is parsed to determine the root domain name corresponding to the website address; based on the preset first classification rule, the target domain name type corresponding to the root domain name is determined , the preset first classification rule includes multiple domain name types; the target domain name type is determined as the second label under the second label set.

Optionally, the processor 502 also has the following functions:

The analysis data includes the network resource information corresponding to the request URL; obtain the web page service corresponding to the resource type to which the network resource information belongs and the first feature information of the web page service; combine the first feature information with preset multiple The feature information of the web page service is matched; if the matching is successful, the target resource type corresponding to the first target feature information is determined, and the first target feature information is the feature information of the plurality of web page services. The first feature information is successfully matched with the first feature information feature information; determine the target resource type as the second tag under the second tag set.

Optionally, the processor 502 also has the following functions:

The analysis data includes the target URL; obtain second feature information of the target URL; match the second feature information with the feature information of multiple preset URLs; if the matching is successful, determine that it corresponds to the second target feature information The URL type of the URL, the second target feature information is the feature information that successfully matches the second feature information in the feature information of the multiple URLs; the URL type is determined as the second tag under the second tag set.

Optionally, the processor 502 also has the following functions:

The analysis data includes historical visit summary information of the website; in the historical visit summary information, obtain first visit summary information within a preset time period, and the first visit summary information includes the number of visits to the website by the target user; Clustering the number of visits at each moment in the preset time period to obtain an access curve corresponding to the preset time period, where the access curve is used to reflect the number of visits of the target user to the website at each moment; the visit The third feature information of the curve is matched with the feature information corresponding to the preset multiple access curves; if the matching is successful, the target label corresponding to the third target feature information is determined, and the third target feature information is the multiple access curves. Among the feature information corresponding to the curves respectively, the feature information that is successfully matched with the third feature information; the target label is determined as the second label under the second label set.

In the above-mentioned embodiments, it may be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented in software, it can be implemented in whole or in part in the form of a computer program product.

The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present application are generated. The computer may be a general purpose computer, special purpose computer, computer network, or other programmable device. The computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be downloaded from a website site, computer, server, or data center Transmission to another website site, computer, server, or data center is by wire (eg, coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (eg, infrared, wireless, microwave, etc.). The computer-readable storage medium may be any available medium that can be stored by a computer, or a data storage device such as a server, data center, etc., which includes one or more available media integrated. The usable media may be magnetic media (eg, floppy disks, hard disks, magnetic tapes), optical media (eg, DVD), or semiconductor media (eg, Solid State Disk (SSD)), among others.

Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the system, device and unit described above may refer to the corresponding process in the foregoing method embodiments, which will not be repeated here.

In the several embodiments provided in this application, it should be understood that the disclosed system, apparatus and method may be implemented in other manners. For example, the apparatus embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not implemented. On the other hand, the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, and may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.

In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit. The above-mentioned integrated units may be implemented in the form of hardware, or may be implemented in the form of software functional units.

The integrated unit, if implemented in the form of a software functional unit and sold or used as an independent product, may be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the present application can be embodied in the form of software products in essence, or the parts that contribute to the prior art, or all or part of the technical solutions, and the computer software products are stored in a storage medium , including several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disk and other media that can store program codes .

As mentioned above, the above embodiments are only used to illustrate the technical solutions of the present application, but not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand: The technical solutions described in the embodiments are modified, or some technical features thereof are equivalently replaced; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions in the embodiments of the present application.

Claims (11)

1. A method of user tagging, comprising:

acquiring user data of a target user from a user information system, and determining a first label set according to the user data, wherein the first label set comprises at least one first label corresponding to the user data;

acquiring network access log data corresponding to the target user from a cloud protection system;

analyzing the network access log data based on a preset rule, and determining a second label set according to an analysis result, wherein the second label set comprises at least one second label corresponding to the analysis result;

and determining a target label set corresponding to the target user according to the first label set and the second label set, wherein the labels under the target label set are used for marking the target user.

2. The method of claim 1, wherein determining the first set of tags based on the user data comprises:

extracting information of the user data by using a Named Entity Recognition (NER) technology to obtain entity information corresponding to the target user, and determining a first label set according to the entity information;

wherein the entity information comprises region information; the determining a first set of tags according to the entity information includes: determining the region information as a first label under a first label set; and/or the presence of a gas in the gas,

the entity information comprises organization name information; the determining a first set of tags according to the entity information includes: and acquiring an industry type corresponding to the organization name information, and determining the industry type as a first label under a first label set.

3. The method of claim 2, wherein obtaining the industry type corresponding to the organization name information and determining the industry type as a first label under a first set of labels comprises:

determining a target industry type corresponding to the organization name information based on a preset industry division rule, wherein the preset industry division rule comprises a plurality of industry types corresponding to the organization name information;

determining the target industry type as a first label under a first set of labels.

4. The method of claim 1, wherein analyzing the network access log data based on a preset rule and determining a second set of tags according to the analysis result comprises:

analyzing the network access log data to obtain analysis data, wherein the analysis data comprises at least one of a website address corresponding to the target user, network resource information corresponding to a request Uniform Resource Locator (URL), a target URL and historical access summary information of the website;

and determining a data type corresponding to the analysis data based on a preset rule, and determining a second label set according to the data type.

5. The method of claim 4, wherein the analytics data includes the website address corresponding to the target user; the determining a data type corresponding to the analysis data based on a preset rule and determining a second label set according to the data type includes:

resolving the website address, and determining a root domain name corresponding to the website address;

determining a target domain name type corresponding to the root domain name based on a preset first classification rule, wherein the preset first classification rule comprises a plurality of domain name types;

and determining the target domain name type as a second label under a second label set.

6. The method of claim 4, wherein the analysis data includes the network resource information corresponding to the request URL; the determining a data type corresponding to the analysis data based on a preset rule and determining a second label set according to the data type includes:

acquiring a webpage service corresponding to a resource type to which the network resource information belongs and first characteristic information of the webpage service;

matching the first characteristic information with the characteristic information of a plurality of preset web services;

if the matching is successful, determining a target resource type corresponding to first target characteristic information, wherein the first target characteristic information is the characteristic information successfully matched with the first characteristic information in the characteristic information of the plurality of webpage services;

and determining the target resource type as a second label under a second label set.

7. The method of claim 4, wherein the analytics data comprises the target URL; the determining a data type corresponding to the analysis data based on a preset rule, and determining a second tag set according to the data type includes:

acquiring second characteristic information of the target URL;

matching the second characteristic information with the characteristic information of a plurality of preset URLs;

if the matching is successful, determining a URL type corresponding to second target characteristic information, wherein the second target characteristic information is the characteristic information successfully matched with the second characteristic information in the characteristic information of the URLs;

and determining the URL type as a second label under a second label set.

8. The method of claim 4, wherein the analytics data includes historical visit summary information for the website; the determining a data type corresponding to the analysis data based on a preset rule and determining a second label set according to the data type includes:

acquiring first access summary information in a preset time period from the historical access summary information, wherein the first access summary information comprises the access times of the target user to the website;

clustering the access times of all the moments in the preset time period to obtain an access curve corresponding to the preset time period, wherein the access curve is used for reflecting the access times of the target user to the website at all the moments;

matching the third characteristic information of the access curves with the characteristic information corresponding to a plurality of preset access curves respectively;

if the matching is successful, determining a target label corresponding to third target characteristic information, wherein the third target characteristic information is the characteristic information which is successfully matched with the third characteristic information in the characteristic information respectively corresponding to the multiple access curves;

and determining the target label as a second label under a second label set.

9. A user tagging system, comprising:

the first data acquisition module is used for acquiring user data of a target user from a user information system;

a first data processing module, configured to determine a first tag set according to the user data, where the first tag set includes at least one first tag corresponding to the user data;

the second data acquisition module is used for acquiring network access log data corresponding to the target user from the cloud protection system;

the second data processing module is used for analyzing the network access log data based on a preset rule and determining a second label set according to an analysis result, wherein the second label set comprises at least one second label corresponding to the analysis result;

and the user marking module is used for determining a target label set corresponding to the target user according to the first label set and the second label set, wherein the labels under the target label set are used for marking the target user.

10. An electronic device, comprising:

a memory storing executable program code;

and a processor coupled to the memory;

the processor calls the executable program code stored in the memory, which when executed by the processor causes the processor to implement the method of any one of claims 1-8.

11. A computer-readable storage medium having executable program code stored thereon, wherein the executable program code when executed by a processor implements the method of any one of claims 1-8.

Images