Aggregating service data for transmission and risk analysis

Patent metadata

Field	Value
Publication number	US-10417426-B2
Application number	US-201715691098-A
Country	US
Kind code	B2
Filing date	Aug 30, 2017
Priority date	Jul 22, 2016
Publication date	Sep 17, 2019
Grant date	Sep 17, 2019

Abstract

Methods, systems, and computer-readable storage media for risk identification of service data using operations of determining, by a client-side computing device, a first service data corresponding to a first operation behavior associated with a user input on the client-side computing device, determining, by the client-side computing device, a first variable corresponding to the first service data, the first variable including a first eigenvalue, retrieving, by the client-side computing device, a second eigenvalue corresponding to a second operation behavior that was performed at a second time before the first operation behavior, generating, by the client-side computing device, a decay value by processing the first time and the second time a decay function, generating, by the client-side computing device, an aggregated data by processing the first variable, the second eigenvalue, and the decay value using an aggregation function, and determining, by the one or more processors, a risk associated with the first operation by processing the aggregated data using a risk identification model.

First claim

What is claimed is:

1. A computer-implemented method for risk identification of service data, the method being executed by one or more processors and comprising:
determining, by a client-side computing device, a first service data corresponding to a first operation behavior associated with a user input on the client-side computing device;
determining, by the client-side computing device, a first variable corresponding to the first service data, the first variable comprising a first eigenvalue;
retrieving, by the client-side computing device, a second eigenvalue corresponding to a second operation behavior that was performed at a second time before the first operation behavior;
generating, by the client-side computing device, a decay value by processing the first time and the second time using a decay function, the decay value being weighted based upon the second time;
generating, by the client-side computing device, an aggregated data by processing the first variable, the second eigenvalue, and the decay value using an aggregation function; and
determining, by the one or more processors, a risk associated with the first operation by processing the aggregated data using a risk identification model.

2. The method of claim 1 , further comprising, in response to generating the aggregated data, deleting the second eigenvalue.

3. The method of claim 1 , wherein the one or more processors are integrated in a server-side computing device.

4. The method of claim 3 , further comprising transmitting the aggregated data from the client-side computing device to the server-side computing device.

5. The method of claim 4 , wherein the aggregation function comprises a mathematical operation defining at least one of a summing operation, an identification of a maximum value, and an identification of non-repetitive results.

6. The method of claim 1 , wherein the decay function comprises a mathematical operation defining at least one of an exponential function, a logarithmic function, a trigonometric function, a moving window type function, and a polynomial type function.

7. The method of claim 1 , further comprising displaying the risk associated with the first operation to a user of the client-side computing device.

8. A non-transitory, computer-readable medium storing one or more instructions executable by a computer system to perform operations comprising:
determining, by a client-side computing device, a first service data corresponding to a first operation behavior associated with a user input on the client-side computing device;
determining, by the client-side computing device, a first variable corresponding to the first service data, the first variable comprising a first eigenvalue;
retrieving, by the client-side computing device, a second eigenvalue corresponding to a second operation behavior that was performed at a second time before the first operation behavior;
generating, by the client-side computing device, a decay value by processing the first time and the second time using a decay function, the decay value being weighted based upon the second time;
generating, by the client-side computing device, an aggregated data by processing the first variable, the second eigenvalue, and the decay value using an aggregation function; and
determining, by the one or more processors, a risk associated with the first operation by processing the aggregated data using a risk identification model.

9. The non-transitory, computer-readable medium of claim 8 , further comprising, in response to generating the aggregated data, deleting the second eigenvalue.

10. The non-transitory, computer-readable medium of claim 8 , wherein the one or more processors are integrated in a server-side computing device.

11. The method of claim 10 , further comprising transmitting the aggregated data from the client-side computing device to the server-side computing device.

12. The non-transitory, computer-readable medium of claim 11 , wherein the aggregation function comprises a mathematical operation defining at least one of a summing operation, an identification of a maximum value, and an identification of non-repetitive results.

13. The non-transitory, computer-readable medium of claim 8 , wherein the decay function comprises a mathematical operation defining at least one of an exponential function, a logarithmic function, a trigonometric function, a moving window type function, and a polynomial type function.

14. The non-transitory, computer-readable medium of claim 8 , further comprising displaying the risk associated with the first operation to a user of the client-side computing device.

15. A computer-implemented system, comprising:
one or more computers; and
one or more computer memory devices interoperably coupled with the one or more computers and having tangible, non-transitory, machine-readable media storing instructions that, when executed by the one or more computers, perform operations comprising:
determining, by a client-side computing device, a first service data corresponding to a first operation behavior associated with a user input on the client-side computing device;
determining, by the client-side computing device, a first variable corresponding to the first service data, the first variable comprising a first eigenvalue;
retrieving, by the client-side computing device, a second eigenvalue corresponding to a second operation behavior that was performed at a second time before the first operation behavior;
generating, by the client-side computing device, a decay value by processing the first time and the second time using a decay function, the decay value being weighted based upon the second time;
generating, by the client-side computing device, an aggregated data by processing the first variable, the second eigenvalue, and the decay value using an aggregation function; and
determining, by the one or more processors, a risk associated with the first operation by processing the aggregated data using a risk identification model.

16. The computer-implemented system of claim 15 , further comprising, in response to generating the aggregated data, deleting the second eigenvalue.

17. The computer-implemented system of claim 15 , wherein the one or more processors are integrated in a server-side computing device.

18. The computer-implemented system of claim 17 , further comprising transmitting the aggregated data from the client-side computing device to the server-side computing device.

19. The method of claim 18 , wherein the aggregation function comprises a mathematical operation defining at least one of a summing operation, an identification of a maximum value, and an identification of non-repetitive results.

20. The computer-implemented system of claim 19 , wherein the decay function comprises a mathematical operation defining at least one of an exponential function, a logarithmic function, a trigonometric function, a moving window type function, and a polynomial type function.

Assignees

• Alibaba Group Holding Ltd

Inventors

• Chen Lujia
• Zhou Qingyue
• Wang Weiqiang

Classifications

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06F2221/2115

  Third party · CPC title

• G06F21/554

  involving event detection and direct action · CPC title

• G06F21/552

  involving long-term monitoring or reporting · CPC title