CN116126808A - Behavior log recording method, device, computer equipment and storage medium - Google Patents

Abstract

The present invention relates to a behavior log recording method, device, computer equipment and storage medium. The method includes: monitoring the operation behavior of an application program, acquiring behavior data generated according to the operation behavior; inputting the behavior data into a pre-configured analysis model to determine whether the behavioral data is sensitive behavioral data; if the behavioral data is sensitive behavioral data, then save the behavioral data in the preset cache area, and there are multiple records stored in the preset storage area Sensitive behavior; send an asynchronous request message to the behavior log manager, and the asynchronous request message is used to request to send the sensitive behavior data to the log manager; after receiving the response message from the log manager, send the sensitive The behavior data is sent to the message queue; the sensitive behavior data is taken out from the message queue and written into the log manager. The above method can better support the storage requirements of security audit.

Description

Behavior log recording method, device, computer equipment and storage medium

technical field

The invention relates to the testing field, in particular to a behavior log recording method, device, computer equipment and storage medium.

Background technique

As a conventionally developed business application system, it provides users with a series of operation interfaces to complete specific functions. Under these main functions, security or auditing will raise other requirements, such as the need to record the behavior of each user, when and what action was taken, for later security audit or optimization.

The general solution is to print these behaviors as logs to the current server when the user operates certain functions. It can meet the requirements, but the files of this printing method are scattered in various servers, which is not conducive to collecting statistics. If security proposes to record behavior logs in other storage systems, it is inevitable to carry out a series of transformation and development, which is not conducive to expansion.

Contents of the invention

Based on this, it is necessary to provide a behavior log recording method, device, computer equipment and storage medium.

A behavioral logging method comprising:

Monitor the application program to perform operation behavior, and obtain behavior data generated according to the operation behavior, wherein the behavior data includes one or a combination of user identification, operation behavior event, time stamp and operation time value;

Input the behavior data into a pre-configured analysis model to determine whether the behavior data is sensitive behavior data;

If the behavior data is sensitive behavior data, storing the behavior data in a preset cache area, where multiple sensitive behaviors are stored in the preset storage area;

sending an asynchronous request message to the behavior log manager, where the asynchronous request message is used to request sending the sensitive behavior data to the log manager;

After receiving the response message from the log manager, sending the sensitive behavior data to a message queue;

The sensitive behavior data is taken out from the message queue and written into the log manager.

In one of the embodiments, the acquisition of the behavior data generated according to the operation behavior includes:

Obtain the behavior data reported by different buried point objects in real time based on preset buried point parameters;

Wherein, the different buried point objects include: at least one of the H5 pages displayed by the browser, applets, APP clients, and PC clients; the preset buried point parameters include: at least one of different attribute fields and attribute screening conditions one item.

In one of the embodiments, inputting the behavior data into a pre-configured analysis model to determine whether the behavior data is sensitive behavior data includes:

Extracting the time stamp, operation time value and operation behavior event of the behavior data;

performing feature extraction on the timestamp, the operation time value, and the operation behavior event to obtain a feature vector of the behavior data;

Calling the analysis model to perform label prediction on the feature vector to obtain the label of the behavior data, wherein the analysis model is generated by performing model training on the behavior data carrying the label;

Judging whether the behavior data is sensitive behavior data according to the label of the behavior data.

In one of the embodiments, the judging whether the behavior data is sensitive behavior data according to the label of the behavior data includes:

Whether the behavior data is sensitive behavior data is determined according to the correspondence between the preset tags and the frequency and/or quantity of the behavior data being the tags within a preset time period.

In one of the embodiments, the message queue includes different topic queues, and the different topic queues correspond to behavior data of different operation behavior events;

The sending the sensitive behavior data to the message queue includes:

Sending the sensitive behavior data to the topic queue corresponding to the operation behavior event type in the message queue.

In one of the embodiments, after taking out the sensitive behavior data from the message queue and writing it into the log manager, it further includes:

determining the category group to which the behavior data belongs according to the operation behavior event;

Analyzing the user identifier from the sensitive behavior data stored within the preset time period, and determining the behavior data corresponding to the same user identifier;

The operation behavior sequence of the user is determined according to the operation behavior events and category groups belonging to the behavior data of the same user.

In one of the embodiments, the determining the operation behavior sequence of the user according to the operation behavior events and category groups belonging to the behavior data of the same user includes:

Based on the sequence of timestamps, the initial sequence is determined according to the operational behavior events and category groups of log records belonging to the same user;

The initial sequence is divided into subsequences according to the operation time value, and the at least one subsequence is determined as the user's operation behavior sequence.

A kind of behavior logging device, described testing device comprises:

The data acquisition unit is configured to monitor the execution of the application program, and acquire the behavior data generated according to the operation behavior, wherein the behavior data includes one or a combination of user identification, operation behavior event, time stamp and operation time value;

A data analysis unit, configured to input the behavior data into a pre-configured analysis model to determine whether the behavior data is sensitive behavior data;

A data cache unit, configured to store the behavior data in a preset cache area if the behavior data is sensitive behavior data, where multiple sensitive behaviors are stored in the preset storage area;

A transmission request unit, configured to send an asynchronous request message to the behavior log manager, where the asynchronous request message is used to request to send the sensitive behavior data to the log manager;

A data transmission unit, configured to send the sensitive behavior data to a message queue after receiving the response message from the log manager;

A data cache unit, configured to take out the sensitive behavior data from the message queue and write it into the log manager.

A computer device, comprising a memory and a processor, wherein computer-readable instructions are stored in the memory, and when the computer-readable instructions are executed by the processor, the processor executes the above-mentioned behavior log recording method step.

A storage medium storing computer-readable instructions. When the computer-readable instructions are executed by one or more processors, the one or more processors execute the steps of the above-mentioned behavior logging method.

The above-mentioned behavior log recording method, device, computer equipment, and storage medium obtain behavior data generated according to the operation behavior by monitoring the operation behavior of the application program, wherein the behavior data includes user identification, operation behavior events, time stamps and One or a combination of operation time values; input the behavior data into the pre-configured analysis model to judge whether the behavior data is sensitive behavior data; if the behavior data is sensitive behavior data, then save the behavior data to the preset In the cache area, there are multiple sensitive behaviors stored in the preset storage area; an asynchronous request message is sent to the behavior log manager, and the asynchronous request message is used to request to send the sensitive behavior data to the log manager; After receiving the response message from the log manager, sending the sensitive behavior data to a message queue; taking out the sensitive behavior data from the message queue and writing it into the log manager. Therefore, there is no need to worry that the behavior collector will affect user operations. The completely decoupled model design minimizes the impact of the behavior collector on user operations; the unified MQ push collector avoids the original way of printing logs and disperses behavior logs in various In the business server, it is now handed over to MQ for unified collection and unified push; the back-end storage interface layer supports users to support more storage through configuration, and better supports the storage requirements of security audits.

Description of drawings

Fig. 1 is a schematic diagram of an application environment of a behavior log recording method in an embodiment of the present invention;

Fig. 2 is a schematic flow chart of a behavior log recording method in an embodiment of the present invention;

Fig. 3 is a schematic structural diagram of a behavior log recording device in an embodiment of the present invention;

Fig. 4 is a schematic structural diagram of computer equipment in an embodiment of the present invention;

Fig. 5 is another structural schematic diagram of a computer device in an embodiment of the present invention.

Detailed ways

In order to make the object, technical solution and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain the present invention, not to limit the present invention.

The behavior log recording method provided by the embodiment of the present invention can be applied in the application environment as shown in FIG. 1 , wherein the client communicates with the server through the network. The server can monitor the operation behavior of the application program through the client, and obtain the behavior data generated according to the operation behavior, wherein the behavior data includes one or a combination of user identification, operation behavior event, time stamp and operation time value; The behavior data is input into a pre-configured analysis model to determine whether the behavior data is sensitive behavior data; if the behavior data is sensitive behavior data, the behavior data is saved in a preset cache area, and the preset There are multiple sensitive behaviors stored in the storage area; an asynchronous request message is sent to the behavior log manager, and the asynchronous request message is used to request to send the sensitive behavior data to the log manager; a response from the log manager is received After the message, the sensitive behavior data is sent to the message queue; the sensitive behavior data is taken out from the message queue and written to the log manager (server). For insurance entities, you can use entity alignment to optimize the Q&A engine solution. First, perform rough sorting based on semantic matching, and then adjust the sorting through entity alignment. Select the top matching questions to respond to the answers you get, which can effectively avoid the generalization of the model. It can greatly improve the effect of entity matching and the effect of question answering engine. Among them, the clients can be but not limited to various personal computers, notebook computers, smart phones, tablet computers and portable wearable devices. The server can be implemented by an independent server or a server cluster composed of multiple servers. The present invention will be described in detail below through specific examples.

Please refer to FIG. 2, which is a schematic flowchart of a behavior log recording method provided by an embodiment of the present invention, including the following steps:

S10. Monitor the application program to perform an operation behavior, and obtain behavior data generated according to the operation behavior, wherein the behavior data includes one or a combination of a user identifier, an operation behavior event, a time stamp, and an operation time value;

Among them, the application program refers to the application program that can carry out activities involving the user's personal property such as shopping, payment, transfer, and loan, such as: Alipay, WeChat, mobile banking, etc., and the user can add in the terminal according to actual needs. application. The terminal can monitor the operation behavior of each application program in real time through the callback function. When the user performs operations such as shopping, payment, transfer, and loan on the application program, click the operation button to generate an operation instruction, and the application program can execute the corresponding operation according to the operation instruction. Operation behavior, and at the same time call the callback function to pass the execution information to the operating system of the terminal.

When the operating system of the terminal receives the execution information transmitted by the application program, it can obtain the application program identification that is executing the operation behavior according to the execution information, and transmit the collection instruction to the target application program according to the application program identification program, so as to collect the information of the application program that is executing The behavior data generated by the operation behavior of , where the application identifier can be the application name, application number, etc. Behavior data may include relevant account information for performing the operation behavior, operation content, operation time corresponding to the operation content, address information, etc., wherein the account information may include account ID (identification, identity mark), account name, etc.

In some embodiments, S10 may include: acquiring behavior data reported in real time by different buried point objects based on preset buried point parameters;

Wherein, the different buried point objects include: at least one of the H5 pages displayed by the browser, applets, APP clients, and PC clients; the preset buried point parameters include: at least one of different attribute fields and attribute screening conditions one item.

Specifically, burying refers to setting a piece of burying code somewhere so that the system can obtain log records through this burying code. For example, to record the operation process of the user modifying a certain system information, the modification is to submit the modification information by clicking the "Save" button, then it is necessary to add a buried point code in the "Save" button click operation implementation code, and the settings need to be captured The system will automatically accept the data and save it in the system, so as to realize the query.

Among them, the buried point code is composed of the program code embedded in the browser/application client to collect user behavior data and the program code used to monitor whether the user behavior data collection results are abnormal at the back end. The data captured by the embedded code for user behavior information analysis can be obtained through the embedded code. For example, by nesting a JavaScript script in a web page, when a user visits a web page, a statistical script is triggered to obtain access data, and the back-end Java program judges whether the data structure is abnormal.

When burying points on different burying objects, it is also necessary to preset corresponding burying point parameters. The preset burying point parameters in this embodiment of the present invention may include at least one of different attribute fields and attribute filter conditions. Different attribute fields can include buried point name field, user identification field, device identification field, timestamp field, buried point page name, and so on. When the user behaviors generated on different tracking objects meet the attribute filtering conditions, the tracking objects can be triggered to report the corresponding user behavior logs. Of course, the filtering conditions can also be used as a dimension to describe the characteristics of things. Attribute filter conditions can be divided into public attributes and extended attributes by type. The public attributes are mainly for the default buried point data collection, and are usually integrated in the big data SDK (software development kit, software development kit). Extended attributes are mainly for custom buried point data collection for specific behaviors.

S20. Input the behavior data into a preconfigured analysis model, and judge whether the behavior data is sensitive behavior data;

Among them, the sensitive behavior set can be established in advance, and the operation content included in the sensitive behavior set can be set. For example, the sensitive behavior set can be set to include payment, transfer, loan, repayment and other operation content. The terminal can detect whether the operation content in the behavior data belongs to the pre-established sensitive behavior set, thereby judging whether the operation behavior is a sensitive behavior, and if the operation content belongs to the preset sensitive behavior set, it determines that the operation behavior is a sensitive behavior.

In some embodiments, the inputting the behavior data into a pre-configured analysis model to determine whether the behavior data is sensitive behavior data includes:

S201 extracting the timestamp of the behavior data, the operation time value and the operation behavior event;

S202 Perform feature extraction on the timestamp, the operation time value, and the operation behavior event to obtain a feature vector of the behavior data;

S203 calling the analysis model to perform label prediction on the feature vector to obtain the label of the behavior data, wherein the analysis model is generated by performing model training on the behavior data carrying the label;

S204 Determine whether the behavior data is sensitive behavior data according to the label of the behavior data.

Wherein, the timestamp is used to indicate the generation time of the log record, for example, timestamp 1 indicates that log record 1 is generated at timestamp 1, timestamp 2 indicates that log record 2 is generated at timestamp 2, and so on. You can agree on the format of the timestamp (such as the format of year, month, day, hour, minute, second, etc.), and use this format to record the timestamp in the data structure. There is no restriction on the format of the timestamp, and it can be used according to actual needs configuration.

The operation time value is used to represent the operation time value of the operation behavior event, for example, 3 seconds in the log record 1 indicates that the login operation for user information 1 took a total of 3 seconds. The 6 seconds in log record 2 indicates that the search operation for user information 1 took a total of 6 seconds, and so on.

Wherein, the model is generated by performing model training on behavior log samples carrying labels. also

It can be understood that the analysis model is based on the input operations recorded in a large number of behavior log samples, and a mapping relationship is established between the input operations and their corresponding labels.

Therefore, based on the model, it is possible to predict the label of the feature vector of the input operation according to the established mapping relationship between the input operation and its corresponding label, so as to predict the label corresponding to the input operation. For example, if the feature vector of the input operation is very similar or even consistent with a certain feature vector in the mapping relationship, then the label that has a mapping relationship with the certain feature vector can be regarded as the label corresponding to the input operation, thereby completing label prediction.

Further, the tags include legal tags and illegal tags, where the legal tags are used to represent legal operations in the input operations, and the illegal tags are used to represent illegal operations in the input operations.

Furthermore, the tag is uniquely identified by numbers, letters, a combination of the two, or other character strings. For example, a legal label is identified as 1, and an illegal label is identified as 0.

In some embodiments, S204 may include:

Whether the behavior data is sensitive behavior data is determined according to the correspondence between the preset tags and the frequency and/or quantity of the behavior data being the tags within a preset time period.

S30. If the behavior data is sensitive behavior data, save the behavior data in a preset cache area, where multiple sensitive behaviors are stored in the preset storage area;

Wherein, the preset cache area may be a storage space in the local memory of the client. Before saving the log data in the preset cache area, a part of storage space may be applied for in the local memory of the client as the preset cache area.

S40. Send an asynchronous request message to the behavior log manager, where the asynchronous request message is used to request sending the sensitive behavior data to the log manager;

Among them, in the current application system, an asynchronous thread is started, and the asynchronous thread monitors whether there is a behavior log record in the current memory in real time. If there is, it will be pulled in time. After pulling the behavior log, it will be pushed to the At the storage layer, after the push is completed, the behavior log records in the original memory will be deleted.

S50. After receiving the response message from the log manager, send the sensitive behavior data to a message queue;

Among them, through the use of asynchronous threads and MQ, the actions of user behavior logging are completely decoupled from the behavior of user operations, so the actions of recording user behavior will not affect user operations.

In some embodiments, S50 may include: the sending the sensitive behavior data to a message queue includes:

Sending the sensitive behavior data to the topic queue corresponding to the operation behavior event type in the message queue.

S60. Take the sensitive behavior data from the message queue and write it into the log manager.

In some embodiments, after S60, it may also include:

S70 Determine the category group to which the behavior data belongs according to the operation behavior event;

S80: Parsing out user identifiers from the sensitive behavior data stored within a preset period of time, and determining behavior data corresponding to the same user identifier;

S90 Determine the user's operation behavior sequence according to the operation behavior events and category groups belonging to the same user's behavior data.

In some embodiments, S90 may include: 7. The behavior log recording method according to claim 6, wherein the user's operation is determined according to the operation behavior events and category groups belonging to the behavior data of the same user Behavior sequence, including:

S91 determines the initial sequence based on the order of time stamps, according to the operational behavior events and category groups recorded in logs belonging to the same user;

S92 Divide the initial sequence into subsequences according to the operation time value, and determine the at least one subsequence as the user's operation behavior sequence.

It can be seen from the above scheme that when the user performs system operations, the interceptor will intercept the user's operation behavior, and the behavior analyzer will analyze whether the user's current behavior needs to be recorded. If it needs to be recorded, it will mark the current operation behavior and assemble into a complete record (main fields: user account, operation action, operation time); the behavior statistic device stores the record in the current application memory. It is pushed to the storage layer through the transmitter, which is completely asynchronous and decoupled. In the current application system, start an asynchronous thread, and the asynchronous thread monitors whether there is a behavior log record in the current memory in real time. If there is, it will pull it in time. After pulling the behavior log, push it to the storage layer through the MQ client tool , after the push is completed, the behavior log records in the original memory will be deleted. Through the use of asynchronous threads and MQ, the user behavior logging action is completely decoupled from the user operation behavior, so the action of recording user behavior will not affect the user's operation. The storage layer is mainly to receive the pushed user behavior logs and save them. Provides a unified storage interface, and the backend adapts to various storages. After the asynchronous log pusher pushes the user behavior log to MQ, MQ will push it to the unified storage interface layer, and the storage interface layer will save the message in different storages according to the user's storage configuration type. Storage can be local file system, ES storage engine, DB database and other types.

It can be seen that in the above scheme, there is no need to worry that the behavior collector will affect user operations. The completely decoupled model design minimizes the impact of the behavior collector on user operations; the unified MQ push collector avoids the original way of printing logs. Behavior logs are scattered in various business servers, and now they are collected and pushed by MQ in a unified manner; the back-end storage interface layer supports users to support more storage through configuration, and better supports the storage requirements of security audits.

It should be understood that the sequence numbers of the steps in the above embodiments do not mean the order of execution, and the execution order of each process should be determined by its functions and internal logic, and should not constitute any limitation to the implementation process of the embodiment of the present invention.

In one embodiment, a behavior log recording device is provided, and the behavior log recording device corresponds to the behavior log recording method in the above-mentioned embodiments one by one. As shown in FIG. 3 , the behavior logging device includes a data acquisition unit 101 , a data analysis unit 102 , a data cache unit 103 , a transmission request unit 104 , a data transmission unit 105 and a data cache unit 106 . The detailed description of each functional module is as follows:

The data acquisition unit 101 is configured to monitor the operation behavior of the application program, and acquire behavior data generated according to the operation behavior, wherein the behavior data includes one or a combination of a user identifier, an operation behavior event, a time stamp, and an operation time value;

A data analysis unit 102, configured to input the behavior data into a preconfigured analysis model to determine whether the behavior data is sensitive behavior data;

A data cache unit 103, configured to store the behavior data in a preset cache area if the behavior data is sensitive behavior data, where multiple sensitive behaviors are stored in the preset storage area;

A transmission request unit 104, configured to send an asynchronous request message to the behavior log manager, where the asynchronous request message is used to request to send the sensitive behavior data to the log manager;

The data transmission unit 105 is configured to send the sensitive behavior data to a message queue after receiving the response message from the log manager;

The data cache unit 106 is configured to take the sensitive behavior data from the message queue and write it into the log manager.

In some embodiments, the data acquisition unit 101 is specifically used for:

Obtain the behavior data reported by different buried point objects in real time based on preset buried point parameters;

Wherein, the different buried point objects include: at least one of the H5 pages displayed by the browser, applets, APP clients, and PC clients; the preset buried point parameters include: at least one of different attribute fields and attribute screening conditions one item.

In some embodiments, the data analysis unit 102 is specifically used for:

Extracting the time stamp, operation time value and operation behavior event of the behavior data;

performing feature extraction on the timestamp, the operation time value, and the operation behavior event to obtain a feature vector of the behavior data;

Calling the analysis model to perform label prediction on the feature vector to obtain the label of the behavior data, wherein the analysis model is generated by performing model training on the behavior data carrying the label;

Judging whether the behavior data is sensitive behavior data according to the label of the behavior data.

In some embodiments, the transmission request unit 104 is specifically configured to: according to the correspondence between the preset tag and the frequency and/or quantity of the tag in the behavior data within the preset time period, determine the Whether the above behavioral data is sensitive behavioral data.

In some embodiments, the message queue includes different topic queues, and the different topic queues correspond to behavior data of different operation behavior events;

The data transmission unit 105 is specifically configured to: send the sensitive behavior data to the message queue, including:

Sending the sensitive behavior data to the topic queue corresponding to the operation behavior event type in the message queue.

In some embodiments, the data cache unit 106 is specifically used for:

determining the category group to which the behavior data belongs according to the operation behavior event;

Analyzing the user identifier from the sensitive behavior data stored within the preset time period, and determining the behavior data corresponding to the same user identifier;

The operation behavior sequence of the user is determined according to the operation behavior events and category groups belonging to the behavior data of the same user.

For the specific limitations of the behavior log recording device, please refer to the above-mentioned limitations on the smart Q&A method, and details will not be repeated here. Each module in the above-mentioned behavior log recording device can be fully or partially realized by software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, and can also be stored in the memory of the computer device in the form of software, so that the processor can invoke and execute the corresponding operations of the above-mentioned modules.

In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure may be as shown in FIG. 4 . The computer device includes a processor, memory, network interface and database connected by a system bus. Wherein, the processor of the computer device is used to provide calculation and control capabilities. The memory of the computer device includes non-volatile and/or volatile storage media and internal memory. The non-volatile storage medium stores an operating system, computer programs and databases. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The network interface of the computer device is used to communicate with external clients via a network connection. When the computer program is executed by the processor, the functions or steps at the server side of a behavior logging method are realized.

In one embodiment, a computer device is provided. The computer device may be a client, and its internal structure may be as shown in FIG. 5 . The computer device includes a processor, a memory, a network interface, a display screen and an input device connected through a system bus. Wherein, the processor of the computer device is used to provide calculation and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The network interface of the computer device is used to communicate with the external server through the network connection. When the computer program is executed by the processor, the functions or steps on the client side of a behavior logging method are realized

In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored on the memory and operable on the processor. When the processor executes the computer program, the following steps are implemented:

Monitor the application program to perform operation behavior, and obtain behavior data generated according to the operation behavior, wherein the behavior data includes one or a combination of user identification, operation behavior event, time stamp and operation time value;

Input the behavior data into a pre-configured analysis model to determine whether the behavior data is sensitive behavior data;

If the behavior data is sensitive behavior data, storing the behavior data in a preset cache area, where multiple sensitive behaviors are stored in the preset storage area;

sending an asynchronous request message to the behavior log manager, where the asynchronous request message is used to request sending the sensitive behavior data to the log manager;

After receiving the response message from the log manager, sending the sensitive behavior data to a message queue;

The sensitive behavior data is taken out from the message queue and written into the log manager.

In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

Monitor the application program to perform operation behavior, and obtain behavior data generated according to the operation behavior, wherein the behavior data includes one or a combination of user identification, operation behavior event, time stamp and operation time value;

Input the behavior data into a pre-configured analysis model to determine whether the behavior data is sensitive behavior data;

If the behavior data is sensitive behavior data, storing the behavior data in a preset cache area, where multiple sensitive behaviors are stored in the preset storage area;

sending an asynchronous request message to the behavior log manager, where the asynchronous request message is used to request sending the sensitive behavior data to the log manager;

After receiving the response message from the log manager, sending the sensitive behavior data to a message queue;

The sensitive behavior data is taken out from the message queue and written into the log manager.

It should be noted that, for the functions or steps that can be realized by the computer-readable storage medium or the computer device, you can refer to the relevant descriptions on the server side and the client side in the foregoing method embodiments. To avoid repetition, no more Describe them one by one.

Those of ordinary skill in the art can understand that realizing all or part of the processes in the methods of the above embodiments can be completed by instructing related hardware through a computer program, and the computer program can be stored in a computer-readable storage medium. During execution, it may include the processes of the embodiments of the above-mentioned methods. Wherein, the aforementioned storage medium may be a nonvolatile storage medium such as a magnetic disk, an optical disk, a read-only memory (Read-Only Memory, ROM), or a random access memory (Random Access Memory, RAM).

The technical features of the above-mentioned embodiments can be combined arbitrarily. To make the description concise, all possible combinations of the technical features in the above-mentioned embodiments are not described. However, as long as there is no contradiction in the combination of these technical features, should be considered as within the scope of this specification.

The above-mentioned embodiments only express several implementation modes of the present invention, and the descriptions thereof are relatively specific and detailed, but should not be construed as limiting the patent scope of the present invention. It should be noted that those skilled in the art can make several modifications and improvements without departing from the concept of the present invention, and these all belong to the protection scope of the present invention. Therefore, the protection scope of the patent for the present invention should be based on the appended claims.

Claims (10)

1. A behavior logging method, characterized in that, comprising: Monitor the application program to perform operation behavior, and obtain behavior data generated according to the operation behavior, wherein the behavior data includes one or a combination of user identification, operation behavior event, time stamp and operation time value; Input the behavior data into a pre-configured analysis model to determine whether the behavior data is sensitive behavior data; If the behavior data is sensitive behavior data, storing the behavior data in a preset cache area, where multiple sensitive behaviors are stored in the preset storage area; sending an asynchronous request message to the behavior log manager, where the asynchronous request message is used to request sending the sensitive behavior data to the log manager; After receiving the response message from the log manager, sending the sensitive behavior data to a message queue; The sensitive behavior data is taken out from the message queue and written into the log manager. 2. The behavior log recording method according to claim 1, wherein said obtaining the behavior data generated according to said operation behavior comprises: Obtain the behavior data reported by different buried point objects in real time based on preset buried point parameters; Wherein, the different buried point objects include: at least one of the H5 pages displayed by the browser, applets, APP clients, and PC clients; the preset buried point parameters include: at least one of different attribute fields and attribute screening conditions one item. 3. The behavior log recording method according to claim 1, wherein the input of the behavior data into a preconfigured analysis model to judge whether the behavior data is sensitive behavior data comprises: Extracting the time stamp, operation time value and operation behavior event of the behavior data; performing feature extraction on the timestamp, the operation time value, and the operation behavior event to obtain a feature vector of the behavior data; Calling the analysis model to perform label prediction on the feature vector to obtain the label of the behavior data, wherein the analysis model is generated by performing model training on the behavior data carrying the label; Judging whether the behavior data is sensitive behavior data according to the label of the behavior data. 4. The behavior logging method according to claim 3, wherein said judging whether said behavior data is sensitive behavior data according to the label of said behavior data comprises: Whether the behavior data is sensitive behavior data is determined according to the correspondence between the preset tags and the frequency and/or quantity of the behavior data being the tags within a preset time period. 5. The behavior logging method according to claim 1, wherein the message queue comprises different topic queues, and the different topic queues correspond to behavior data of different operational behavior events; The sending the sensitive behavior data to the message queue includes: Sending the sensitive behavior data to the topic queue corresponding to the operation behavior event type in the message queue. 6. The behavior log recording method according to claim 1, further comprising: determining the category group to which the behavior data belongs according to the operation behavior event; Analyzing the user identifier from the sensitive behavior data stored within the preset time period, and determining the behavior data corresponding to the same user identifier; The operation behavior sequence of the user is determined according to the operation behavior events and category groups belonging to the behavior data of the same user. 7. The behavior log recording method according to claim 6, wherein said determining the user's operation behavior sequence according to the operation behavior events and category groups belonging to the same user's behavior data includes: Based on the sequence of timestamps, the initial sequence is determined according to the operational behavior events and category groups of log records belonging to the same user; The initial sequence is divided into subsequences according to the operation time value, and the at least one subsequence is determined as the user's operation behavior sequence. 8. A behavior logging device, characterized in that the testing device comprises: The data acquisition unit is configured to monitor the execution of the application program, and acquire the behavior data generated according to the operation behavior, wherein the behavior data includes one or a combination of user identification, operation behavior event, time stamp and operation time value; A data analysis unit, configured to input the behavior data into a pre-configured analysis model to determine whether the behavior data is sensitive behavior data; A data cache unit, configured to store the behavior data in a preset cache area if the behavior data is sensitive behavior data, where multiple sensitive behaviors are stored in the preset storage area; A transmission request unit, configured to send an asynchronous request message to the behavior log manager, where the asynchronous request message is used to request to send the sensitive behavior data to the log manager; A data transmission unit, configured to send the sensitive behavior data to a message queue after receiving the response message from the log manager; A data cache unit, configured to take out the sensitive behavior data from the message queue and write it into the log manager. 9. A computer device comprising a memory and a processor, wherein computer readable instructions are stored in the memory, and when executed by the processor, the computer readable instructions cause the processor to perform the operations according to claims 1 to 7 The steps of the behavior log recording method according to any one of the claims. 10. A storage medium storing computer-readable instructions, which, when executed by one or more processors, cause one or more processors to perform any one of claims 1 to 7 The steps of the behavior logging method.

Images