A kind of method and apparatus of enterprise staff user's behaviors analysis【Technical field】
The present invention relates to technical field of network security, more precisely a kind of method of enterprise staff user's behaviors analysisAnd device.
【Background technology】
With going from strength to strength for scope of the enterprise, enterprise staff quantity is more and more.Company manager can not understand often in real timeThe work behavior of a enterprise staff can not obtain enterprise staff current working status in real time, and enterprise staff is caused to prepare to leave officeWhen, company manager, which appoints these situations, not to be known about so, and difficulty is brought to job placement.And enterprise staff leave office it is previous as meetingThere are some abnormal behaviours：
1, most of employees will not select first to leave office finds new work again, and necessarily catch up with during looking for a job recruitment fair,Interview etc. expends the process of certain time, these processes can only be realized mostly by asking for leave.
2, it after labor turnover, can generally take office in similar industry or similar position.And original work materials are employeesA prodigious wealth in work largely provides so employee generally can take away company by way of copying or printingMaterial.And these operations generally will be before working or after coming off duty, unit when other people without carrying out.
Enterprise needs to find that the sign of employee's job-hopping reduces company personnel in order to take effective precautionary measures in timeDimission cost, the normal operation of guarantee company's business.
The present invention can be monitored by accessing network behavior to enterprise staff, can find the different of enterprise staff in real timeWhen Chang Hangwei, such as certain employees often access the data bank and downloaded data of company whithin a period of time, then the employee may depositIn the behavior for stealing company technique data, network administrator is prompted to carry out respective handling.
【Invention content】
In view of the foregoing drawbacks, the present invention provides a kind of method and apparatus of enterprise staff user's behaviors analysis.A kind of enterpriseThe method of industry employee's user's behaviors analysis, including：Record enterprise staff network behavior information；To the enterprise staff network behaviorInformation is summarized, is analyzed, and enterprise staff network behavior rule is obtained；Use the enterprise staff network row recorded in a period of timeIt is compared for information and the enterprise staff network behavior rule, if the enterprise staff network recorded in described a period of timeBehavioural information and the enterprise staff network behavior rule are variant, then report the information of enterprise staff network behavior exception.
Optionally, the enterprise staff network behavior information includes：The purpose IP address of network access, access time, visitAsk duration, network flow, the frequency for accessing network, enterprise staff mark；The enterprise staff network behavior rule includes：EnterpriseEmployee for a period of time in network access purpose IP address, network access time centrostigma, enterprise staff for a period of time in networkFlowing of access, the frequency for accessing network.
Optionally, the work plan of enterprise staff is obtained, if the work plan of the enterprise staff is with described one sectionThe enterprise staff network behavior information match of interior record but variant with the enterprise staff network behavior rule, then not onReport the information of enterprise staff network behavior exception.
Optionally, browser label character or figure corresponding text when enterprise staff uses browser access network are obtainedWord；The word of the acquisition is summarized, is analyzed, enterprise staff network is obtained and accesses content rule；Using in a period of timeThe enterprise staff network of record accesses content and the enterprise staff network accesses content rule and is compared, if described one sectionThe enterprise staff network recorded in time accesses content and enterprise staff network access content rule is variant, then reports enterpriseThe information of industry employee network behavior exception.
Optionally, distinctive mark is arranged to some IP address；Network in the enterprise staff network behavior information accessesPurpose IP address include provided with distinctive mark IP address when, report the information of enterprise staff network behavior exception.
In addition the present invention also proposes a kind of device of enterprise staff user's behaviors analysis, including：Logging modle, analysis mouldBlock, judgment module；The logging modle, for recording enterprise staff network behavior information；The analysis module, for describedEnterprise staff network behavior information is summarized, is analyzed, and enterprise staff network behavior rule is obtained；The judgment module, is used forIt is compared using the enterprise staff network behavior information and the enterprise staff network behavior rule that are recorded in a period of time, such asThe enterprise staff network behavior information and the enterprise staff network behavior rule recorded in a period of time described in fruit is variant, thenReport the information of enterprise staff network behavior exception.
Optionally, the enterprise staff network behavior information of the logging modle record includes：The destination IP that network accessesLocation, access time access duration, network flow, the frequency for accessing network, enterprise staff mark；The analysis module is to describedThe user network Behavior law that enterprise staff network behavior information summarized, is analyzed includes：Enterprise staff is for a period of timeThe purpose IP address of interior network access, network access time centrostigma, enterprise staff interior network access traffic, access for a period of timeThe frequency of network.
Optionally, the judgment module, the work plan for obtaining enterprise staff, if the work of the enterprise staffPlan with described a period of time in record enterprise staff network behavior information match but with the user network Behavior lawIt is variant, then the information of enterprise staff network behavior exception is not reported.
Optionally, the logging modle obtains browser label character or figure when enterprise staff uses browser access networkThe corresponding word of shape；The analysis module summarizes the word of the acquisition, is analyzed, and obtains in the access of enterprise staff networkContent regulation is restrained；The judgment module accesses content and the enterprise staff network using the enterprise staff network recorded in a period of timeIt accesses content rule to be compared, if the enterprise staff network recorded in described a period of time accesses content and the enterprise personWork network access content rule is variant, then reports the information of enterprise staff network behavior exception.
Optionally, the judgment module, for distinctive mark to be arranged to some IP address；The judgment module, for sentencingThe purpose IP address that network in the enterprise staff network behavior information of breaking accesses includes the IP address provided with distinctive markWhen, report the information of enterprise staff network behavior exception.
Beneficial effects of the present invention：The present invention can be monitored by accessing network behavior to enterprise staff, Ke YishiThe abnormal behaviour of Shi Faxian enterprise staffs, such as certain employees often access the data bank and downloaded data of company whithin a period of timeWhen, then there may be the behaviors for stealing company technique data by the employee, and network administrator is prompted to carry out respective handling.
【Description of the drawings】
The hardware architecture diagram of Fig. 1 mobile terminals of each embodiment to realize the present invention；
Fig. 2 is the wireless communication system schematic diagram of mobile terminal as shown in Figure 1；
Fig. 3 is the method flow diagram of the embodiment of the method one of enterprise staff user's behaviors analysis provided by the invention.
Fig. 4 is the method flow diagram of the embodiment of the method two of enterprise staff user's behaviors analysis provided by the invention.
Fig. 5 is the method flow diagram of the embodiment of the method three of enterprise staff user's behaviors analysis provided by the invention.
Fig. 6 is the method flow diagram of the embodiment of the method four of enterprise staff user's behaviors analysis provided by the invention.
Fig. 7 is the structural schematic diagram of the device embodiment five of enterprise staff user's behaviors analysis provided by the invention.
【Specific implementation mode】
It should be appreciated that the specific embodiments described herein are merely illustrative of the present invention, it is not intended to limit the present invention.
In subsequent description, using for indicating that the suffix of such as " module ", " component " or " unit " of element is onlyThe explanation for being conducive to the present invention, itself does not have a specific meaning.Therefore, " module ", " component " or " unit " can mixGround uses.
Mobile terminal can be implemented in a variety of manners.For example, terminal described in the present invention may include such as movingPhone, smart phone, laptop, digit broadcasting receiver, PDA (personal digital assistant), PAD (tablet computer), PMPThe mobile terminal of (portable media player), navigation device etc. and such as number TV, desktop computer etc. are consolidatedDetermine terminal.Hereinafter it is assumed that terminal is mobile terminal.However, it will be understood by those skilled in the art that in addition to being used in particular for movingExcept the element of purpose, construction according to the embodiment of the present invention can also apply to the terminal of fixed type.
Fig. 1 to realize the present invention the mobile terminal of each embodiment hardware configuration signal.
Mobile terminal 100 may include wireless communication unit 110, A/V (audio/video) input unit 120, user's inputUnit 130, sensing unit 140, output unit 150, memory 160, interface unit 170, controller 180 and power supply unit 190Etc..Fig. 1 shows the mobile terminal with various assemblies, it should be understood that being not required for implementing all groups shownPart.More or fewer components can alternatively be implemented.The element of mobile terminal will be discussed in more detail below.
Wireless communication unit 110 generally includes one or more components, allows mobile terminal 100 and wireless communication systemOr the radio communication between network.For example, wireless communication unit may include broadcasting reception module 111, mobile communication module112, at least one of wireless Internet module 113, short range communication module 114 and location information module 115.
Broadcasting reception module 111 receives broadcast singal and/or broadcast via broadcast channel from external broadcast management serverRelevant information.Broadcast channel may include satellite channel and/or terrestrial channel.Broadcast management server can be generated and sentThe broadcast singal and/or broadcast related information that the server or reception of broadcast singal and/or broadcast related information generate beforeAnd send it to the server of terminal.Broadcast singal may include TV broadcast singals, radio signals, data broadcastingSignal etc..Moreover, broadcast singal may further include the broadcast singal combined with TV or radio signals.Broadcast phaseClosing information can also provide via mobile communications network, and in this case, broadcast related information can be by mobile communication mouldBlock 112 receives.Broadcast singal can exist in a variety of manners, for example, it can be with the electronics of digital multimedia broadcasting (DMB)Program guide (EPG), digital video broadcast-handheld (DVB-H) electronic service guidebooks (ESG) etc. form and exist.BroadcastReceiving module 111 can receive signal broadcast by using various types of broadcast systems.Particularly, broadcasting reception module 111It can be wide by using such as multimedia broadcasting-ground (DMB-T), digital multimedia broadcasting-satellite (DMB-S), digital videoIt broadcasts-holds (DVB-H), the Radio Data System of forward link media (MediaFLO@), received terrestrial digital broadcasting integrated service(ISDB-T) etc. digit broadcasting system receives digital broadcasting.Broadcasting reception module 111, which may be constructed such that, to be adapted to provide for extensivelyBroadcast the various broadcast systems of signal and above-mentioned digit broadcasting system.Via broadcasting reception module 111 receive broadcast singal and/Or broadcast related information can be stored in memory 160 (or other types of storage medium).
Mobile communication module 112 sends radio signals to base station (for example, access point, node B etc.), exterior terminalAnd at least one of server and/or receive from it radio signal.Such radio signal may include that voice is logicalTalk about signal, video calling signal or the various types of data for sending and/or receiving according to text and/or Multimedia Message.
Wireless Internet module 113 supports the Wi-Fi (Wireless Internet Access) of mobile terminal.The module can be internally or externallyIt is couple to terminal.Wi-Fi (Wireless Internet Access) technology involved by the module may include WLAN (Wireless LAN) (Wi-Fi), Wibro(WiMAX), Wimax (worldwide interoperability for microwave accesses), HSDPA (high-speed downlink packet access) etc..
Short range communication module 114 is the module for supporting short range communication.Some examples of short-range communication technology include indigo plantTooth TM, radio frequency identification (RFID), Infrared Data Association (IrDA), ultra wide band (UWB), purple honeybee TM etc..
Location information module 115 is the module of the location information for checking or obtaining mobile terminal.Location information moduleTypical case be GPS (global positioning system).According to current technology, GPS module 115, which calculates, comes from three or more satellitesRange information and correct time information and the Information application triangulation for calculating, to according to longitude, latitudeHighly accurately calculate three-dimensional current location information.Currently, it is defended using three for the method for calculating position and temporal informationStar and the error that calculated position and temporal information are corrected by using an other satellite.In addition, GPS module 115It can be by Continuous plus current location information in real time come calculating speed information.
A/V input units 120 are for receiving audio or video signal.A/V input units 120 may include 121 He of cameraMicrophone 122, camera 121 in video acquisition mode or image capture mode by image capture apparatus obtain static imagesOr the image data of video is handled.Treated, and picture frame may be displayed on display unit 151.It is handled through camera 121Picture frame afterwards can be stored in memory 160 (or other storage mediums) or be sent out via wireless communication unit 110It send, two or more cameras 121 can be provided according to the construction of mobile terminal.Microphone 122 can be in telephone calling model, noteSound (audio data) is received via microphone in record pattern, speech recognition mode etc. operational mode, and can will in this wayAcoustic processing be audio data.Audio that treated (voice) data can be converted in the case of telephone calling model canThe format output of mobile communication base station is sent to via mobile communication module 112.Microphone 122 can implement various types of make an uproarSound eliminates (or inhibition) algorithm to eliminate the noise or do that (or inhibition) generates during sending and receiving audio signalIt disturbs.
User input unit 130 can generate key input data to control each of mobile terminal according to order input by userKind operation.User input unit 130 allows user to input various types of information, and may include keyboard, metal dome, touchPlate (for example, sensitive component of detection variation of resistance, pressure, capacitance etc. caused by being contacted), idler wheel, rocking bar etc.Deng.Particularly, when touch tablet is superimposed upon in the form of layer on display unit 151, touch screen can be formed.
Sensing unit 140 detects the current state of mobile terminal 100, (for example, mobile terminal 100 opens or closes shapeState), the position of mobile terminal 100, user is for the presence or absence of contact (that is, touch input) of mobile terminal 100, mobile terminal100 orientation, the acceleration or deceleration movement of mobile terminal 100 and direction etc., and generate for controlling mobile terminal 100The order of operation or signal.For example, when mobile terminal 100 is embodied as sliding-type mobile phone, sensing unit 140 can senseThe sliding-type phone is to open or close.In addition, sensing unit 140 can detect power supply unit 190 whether provide electric power orWhether person's interface unit 170 couples with external device (ED).Sensing unit 140 may include proximity sensor 141.
Interface unit 170 be used as at least one external device (ED) connect with mobile terminal 100 can by interface.For example,External device (ED) may include wired or wireless headphone port, external power supply (or battery charger) port, wired or nothingLine data port, memory card port, the port for connecting the device with identification module, audio input/output (I/O) endMouth, video i/o port, ear port etc..Identification module can store to use each of mobile terminal 100 for verifying userIt plants information and may include subscriber identification module (UIM), client identification module (SIM), Universal Subscriber identification module (USIM)Etc..In addition, the device with identification module can (hereinafter referred to as " identification device ") take the form of smart card therefore to knowOther device can be connect via port or other attachment devices with mobile terminal 100.Interface unit 170, which can be used for receiving, to be come fromThe input (for example, data information, electric power etc.) of external device (ED) and the input received is transferred in mobile terminal 100One or more elements can be used for the transmission data between mobile terminal and external device (ED).
In addition, when mobile terminal 100 is connect with external base, interface unit 170 may be used as allowing will be electric by itPower provides to the path of mobile terminal 100 from pedestal or may be used as that the various command signals inputted from pedestal is allowed to pass through itIt is transferred to the path of mobile terminal.The various command signals or electric power inputted from pedestal, which may be used as mobile terminal for identification, isThe no signal being accurately fitted on pedestal.Output unit 150 is configured to provide with vision, audio and/or tactile manner defeatedGo out signal (for example, audio signal, vision signal, alarm signal, vibration signal etc.).Output unit 150 may include displayUnit 151, audio output module 152, alarm unit 153 etc..
Display unit 151 may be displayed on the information handled in mobile terminal 100.For example, when mobile terminal 100 is in electricityWhen talking about call mode, display unit 151 can show and converse or other communicate (for example, text messaging, multimedia fileDownload etc.) relevant user interface (UI) or graphic user interface (GUI).When mobile terminal 100 is in video calling patternOr when image capture mode, display unit 151 can show the image of capture and/or the image of reception, show video or figureThe UI or GUI etc. of picture and correlation function.
Meanwhile when display unit 151 and touch tablet in the form of layer it is superposed on one another to form touch screen when, display unit151 may be used as input unit and output device.Display unit 151 may include liquid crystal display (LCD), thin film transistor (TFT)In LCD (TFT-LCD), Organic Light Emitting Diode (OLED) display, flexible display, three-dimensional (3D) display etc. at leastIt is a kind of.Some in these displays may be constructed such that transparence to allow user to be watched from outside, this is properly termed as transparentDisplay, typical transparent display can be, for example, TOLED (transparent organic light emitting diode) display etc..According to specificDesired embodiment, mobile terminal 100 may include two or more display units (or other display devices), for example, movingDynamic terminal may include outernal display unit (not shown) and inner display unit (not shown).Touch screen, which can be used for detecting, to be touchedInput pressure and touch input position and touch input area.
Audio output module 152 can mobile terminal be in call signal reception pattern, call mode, logging mode,It is that wireless communication unit 110 is received or in memory 160 when under the isotypes such as speech recognition mode, broadcast reception modeThe audio data transducing audio signal of middle storage and to export be sound.Moreover, audio output module 152 can provide and movementThe relevant audio output of specific function (for example, call signal receives sound, message sink sound etc.) that terminal 100 executes.Audio output module 152 may include loud speaker, buzzer etc..
Alarm unit 153 can provide output notifying event to mobile terminal 100.Typical event can be withIncluding calling reception, message sink, key signals input, touch input etc..Other than audio or video exports, alarm unit153 can provide output with the generation of notification event in different ways.For example, alarm unit 153 can be in the form of vibrationOutput is provided, when receiving calling, message or some other entrance communications (incomingcommunication), alarm listMember 153 can provide tactile output (that is, vibration) to notify to user.It is exported by tactile as offer, even ifWhen the mobile phone of user is in the pocket of user, user also can recognize that the generation of various events.Alarm unit 153The output of the generation of notification event can be provided via display unit 151 or audio output module 152.
Memory 160 can store the software program etc. of the processing and control operation that are executed by controller 180, Huo ZhekeTemporarily to store oneself data (for example, telephone directory, message, still image, video etc.) through exporting or will export.AndAnd memory 160 can be stored about when the vibration and audio signal for touching the various modes that the when of being applied to touch screen exportsData.
Memory 160 may include the storage medium of at least one type, and the storage medium includes flash memory, hard disk, moreMedia card, card-type memory (for example, SD or DX memories etc.), random access storage device (RAM), static random-access storageDevice (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read only memory(PROM), magnetic storage, disk, CD etc..Moreover, mobile terminal 100 can execute memory with by network connectionThe network storage device of 160 store function cooperates.
The overall operation of the usually control mobile terminal of controller 180.For example, controller 180 executes and voice communication, dataCommunication, video calling etc. relevant control and processing.In addition, controller 180 may include for reproducing (or playback) more matchmakersThe multi-media module 181 of volume data, multi-media module 181 can construct in controller 180, or can be structured as and controlDevice 180 detaches.Controller 180 can be with execution pattern identifying processing, by the handwriting input executed on the touchscreen or pictureIt draws input and is identified as character or image.
Power supply unit 190 receives external power or internal power under the control of controller 180 and provides operation each memberElectric power appropriate needed for part and component.
Various embodiments described herein can with use such as computer software, hardware or any combination thereof calculatingMachine readable medium is implemented.Hardware is implemented, embodiment described herein can be by using application-specific IC(ASIC), digital signal processor (DSP), digital signal processing device (DSPD), programmable logic device (PLD), scene canProgramming gate array (FPGA), controller, microcontroller, microprocessor, is designed to execute function described herein processorAt least one of electronic unit is implemented, and in some cases, such embodiment can be implemented in controller 180.For software implementation, the embodiment of such as process or function can with allow to execute the individual of at least one functions or operationsSoftware module is implemented.Software code can by the software application (or program) write with any programming language appropriate LaiImplement, software code can be stored in memory 160 and be executed by controller 180.
So far, oneself according to its function through describing mobile terminal.In the following, for the sake of brevity, will description such as folded form,Slide type mobile terminal in various types of mobile terminals of board-type, oscillating-type, slide type mobile terminal etc., which is used as, to be shownExample.Therefore, the present invention can be applied to any kind of mobile terminal, and be not limited to slide type mobile terminal.
Mobile terminal 100 as shown in Figure 1 may be constructed such that using via frame or grouping transmission data it is all if anyLine and wireless communication system and satellite-based communication system operate.
The communication system that mobile terminal wherein according to the present invention can operate is described referring now to Fig. 2.
Such communication system can use different air interface and/or physical layer.For example, used by communication systemAir interface includes such as frequency division multiple access (FDMA), time division multiple acess (TDMA), CDMA (CDMA) and universal mobile communications systemSystem (UMTS) (particularly, long term evolution (LTE)), global system for mobile communications (GSM) etc..As non-limiting example, underThe description in face is related to cdma communication system, but such introduction is equally applicable to other types of system.
With reference to figure 2, cdma wireless communication system may include multiple mobile terminals 100, multiple base stations (BS) 270, base stationController (BSC) 275 and mobile switching centre (MSC) 280.MSC280 is configured to and Public Switched Telephony Network (PSTN)290 form interface.MSC280 is also structured to form interface with the BSC275 that can be couple to base station 270 via back haul link.Back haul link can be constructed according to any one of several known interfaces, the interface include such as E1/T1, ATM, IP,PPP, frame relay, HDSL, ADSL or xDSL.It will be appreciated that system may include multiple BSC2750 as shown in Figure 2.
Each BS270 can service one or more subregions (or region), by multidirectional antenna or the day of direction specific directionEach subregion of line covering is radially far from BS270.Alternatively, each subregion can be by two or more for diversity receptionAntenna covers.Each BS270, which may be constructed such that, supports multiple frequency distribution, and each frequency distribution has specific frequency spectrum(for example, 1.25MHz, 5MHz etc.).
What subregion and frequency were distributed, which intersects, can be referred to as CDMA Channel.BS270 can also be referred to as base station transceiverSystem (BTS) or other equivalent terms.In this case, term " base station " can be used for broadly indicating singleBSC275 and at least one BS270.Base station can also be referred to as " cellular station ".Alternatively, each subregion of specific BS270 can be claimedFor multiple cellular stations.
As shown in Figure 2, broadcast singal is sent to the mobile terminal operated in system by broadcsting transmitter (BT) 295100.Broadcasting reception module 111 as shown in Figure 1 is arranged at mobile terminal 100 to receive the broadcast sent by BT295Signal.In fig. 2 it is shown that several global positioning system (GPS) satellites 300.The help of satellite 300 positions multiple mobile terminalsAt least one of 100.
In fig. 2, multiple satellites 300 are depicted, it is understood that, any number of satellite can be utilized to obtain usefulLocation information.GPS module 115 as shown in Figure 1 is generally configured to coordinate with satellite 300 to be believed with obtaining desired positioningBreath.It substitutes GPS tracking techniques or except GPS tracking techniques, the other of the position that can track mobile terminal can be usedTechnology.In addition, at least one GPS satellite 300 can optionally or additionally handle satellite dmb transmission.
As a typical operation of wireless communication system, BS270 receives the reverse link from various mobile terminals 100Signal.Mobile terminal 100 usually participates in call, information receiving and transmitting and other types of communication.Each of the reception of certain base station 270 is anti-It is handled in specific BS270 to link signal.The data of acquisition are forwarded to relevant BSC275.BSC provides callThe mobile management function of resource allocation and coordination including the soft switching process between BS270.The number that BSC275 will also be receivedAccording to MSC280 is routed to, the additional route service for forming interface with PSTN290 is provided.Similarly, PSTN290 withMSC280 forms interface, and MSC and BSC275 form interface, and BSC275 correspondingly controls BS270 with by forward link signalsIt is sent to mobile terminal 100.
Based on above-mentioned mobile terminal hardware configuration and communication system, each embodiment of the method for the present invention is proposed.
Enterprise staff is the main body of enterprise, is the most important resource of enterprise, and the behavior of employee directly affects the existence of enterpriseAnd development.High separation rate can cause product quality, service quality, production efficiency, customer and employee's royalty to decline；Meanwhile it is highSeparation rate can weaken management effect, influence personal management and training quality and employee's Work team Cohesiveness.Labor turnover is ChinaThe inevitable outcome of economic system reform and market economic development, labor turnover appropriate can promote the rational flow of personnel, optimize societyMeeting labour's configuration, advantageously forms good outlook on talented people；But excessively high separation rate can cause the technology of enterprise and experience to be lost in,Employee morale is reduced, increases management cost, seriously affects the competitiveness and production efficiency of enterprise.
With Chinese population bonus quick disappearance, outworker is reduced, and enterprise will face recruitment hardly possible, flow of personnelGreatly, labor cost quickly propels etc. compared with hang-up.It is carefree according to future《2012 leave office and adjust firewood investigation report》It has been shown that, 2012First half of the year Chinese Enterprise averagely adjusts firewood 9.8%, is more than China's GDP amplification, and the separation rate that is averaged of every profession and trade enterprise staff in 2011 reaches18.9%, peak since being financial crisis in 2008；Wherein, traditional service industries employee demission rate is up to 21.2%, manufacturing industryEmployee demission rate is also up to 20.5%.Therefore, labor turnover behavior how is reduced in fierce market competition, stablizes employee team5, improve the focus that working efficiency has become enterprises pay attention.Labor turnover principal element
It is various to cause the factor of labor turnover, but mainly has two aspect of employee's individual factor and organizational factor.
(1) individual factor
1. personal characteristics factor.
Generally comprise age, the term of office, marital status etc..Generally speaking usual young man is more unstable, on the one handIt is young and aggressive, like fangle, causes to be also easy to produce weariness emotion in same tissue for a long time；Another aspect young man has enterprisingThe heart is unreconciled to from start to finish be engaged in a kind of work, it is desirable to obtain better development opportunity.
2. people's family factors.
Generally comprise family income and household's support etc..If the income of employee is that family is most important economical nextSource, with profile's promotion and empirical cumulative, it will usually which job-hoping by self-ability, good to working environment, salary and social benefits are highEnterprise, to improve family economical condition.
3. individual psychology factor.
It is mainly manifested in two aspect of perception of fairness and sense of accomplishment.Emolument is the Psychological Contract of employee and enterprise, the emolument of employeeLevel also will produce following three kinds of psychology relatively in addition to matching with self-ability：First, compared with other colleagues of intra-company；Second is that compared with going together outside company；Third, with oneself actually pay, contribute compared with, having with regard to pole when employee feels unfairness canThe idea left office can be generated.
(2) organizational factor
Organizational factor be cause labor turnover most directly, most basic factor, cover face very to what labor turnover was had an effectExtensively, duty factor and institutional factor are broadly divided into.
1. duty factor.
Mainly there is work dull or complexity, two aspect of operating pressure.Work is excessively dull easily to make employee generate taediumvitae,But complexity is too high, and live load is excessive, and employee can be made to generate psychological pressure, germinates leaving office thought.The physical labor of high intensityIt is dynamic easily to make employee's body and psychologically generate tired out, system is operated in shifts if manufacturing enterprise carries out, and causes employee's daily life system ruleRule is disorderly.Therefore, it is positively related relationship between operating pressure and leaving office.
2. institutional factor.
Institutional factor mainly has three aspect of salary and social benefits system, incentive system and training promotional practice.
These three being proportionate property of aspect, not fair and just emolument, check-up system cannot be promoted for employee and be providedStrong positive foundation, it is discontented to any one all to lead to labor turnover.
Therefore, company manager or Human Resource Department need to find the sign of employee's job-hopping in time, in order to takeThe precautionary measures of effect reduce the dimission cost of company personnel, the normal operation of guarantee company's business.Before enterprise staff is left office, oneAs can all have some abnormal behaviours, mainly have following behavior：
1. proceeding by irregular steps asking half a day or vacation in one day
Most of employees will not select first to leave office finds new work again, and necessarily catches up with recruitment fair, face during looking for a jobExamination etc. expends the process of certain time, these processes can only be realized mostly by asking for leave.
Become mysterious 2. receiving calls
When employee plans to leave office, is inherently chatted with friend, household and this thing is to their suggestion of acquisition, and the connection takenBe mode must be private special line ----mobile phone.In order to ensure that the secret of leaving office plan, mobile phone can be effectively prevented colleagueLearn it.In addition, employee when being connected to the interview notice of new unit, can also avoid working together.
3. office's personal belongings are reduced suddenly
Personal belongings occasionally have increase and decrease in office, this is a normal phenomenon, is originally given no cause for much criticism, if personal belongings are prominentIt so reduces most overnight, that is that this person wants to leave firmly mostly.
4. lengthening working hours suddenly
After labor turnover, can generally it take office in similar industry or similar position.And original work materials are employees existsA prodigious wealth in work largely provides so employee generally can take away company by way of copying or printingMaterial.And these operations generally will be before working or after coming off duty, unit when other people without carrying out.
5. changing working attitude
Once employee's interview passes through, the part of winding up of original unit's work will be terminated as early as possible, be reluctant to solicit again newBusiness.Moreover, prodigious change can occur for the phychology of people at this time, if being usually uncontentious person or taking the bitter with the sweet, justNew work can directly be refused, and definite or rude and unreasonable.If usually very courageous and resolute and the style is strong, it will find an excuseIt evades, and handles affairs and become abnormal round and smooth.
6. the number that exchanges privately with colleague becomes more
First, because rounding-off work is almost processed, the time is more abundant；Second is that the decision left office to oneself hasSome hesitate, so can chat from time to time with colleague, obtain company's present case from colleague there, and leaving office of attacking by innuendoThing, be desirably to obtain colleague to the affirmative of oneself leaving office idea.
Embodiment one
With reference to figure 3, a kind of method of enterprise staff user's behaviors analysis, including：
S101, record enterprise staff network behavior information.
Enterprise staff needs to log in computer progress work disposal daily, after enterprise staff logs in computer, needs to access correspondingNetwork such as accesses internal lan or internet.Enterprise staff can all be received after generally going to work daily using e-mail client softwareSend out mail；Log in the business exchange between enterprises instant message applications progress enterprise staff；Browse internet, decorrelationInformation.
System records the relevant information that enterprise staff accesses network：The purpose IP address that network accesses, access time, accessDuration, network flow, the frequency for accessing network, enterprise staff mark.After obtaining these information, these information preservations to dataIn library, convenient for subsequently analyzing these information.
Network access purpose IP address obtained from network packet, as TCP, udp protocol data packet in obtain；It visitsAsk that the time is that enterprise staff accesses the purpose IP address time started；A length of enterprise staff accesses the purpose IP address when accessDuration, while adding up the enterprise staff accesses network total duration in one day；Network flow accesses for enterprise staff in one day shouldThe network flow of purpose IP address, while adding up the enterprise staff accesses all-network total flow in one day；Access networkFrequency is that enterprise staff accesses some websites or the number of network address in one day；Enterprise staff is identified as the user that user logs in computerThe computer title that name or employee use.
The relevant information that enterprise staff accesses network is recorded, after local data library storage, is also sent to third party's clothesBusiness device is stored, and compiling third-party server is unified to analyze the network behavior of enterprise staff.
S102, enterprise staff network behavior information is summarized, is analyzed, obtaining enterprise staff network behavior rule.
The enterprise staff network information of record is analyzed, purpose IP address (such as user that user mainly accesses is obtained5 IP address informations before the destination IP of access, the purpose IP address that general enterprises employee mainly accesses are strong with oneself workRelevant server).It is first turned on Mail Clients receiving and dispatching mail after going to work daily such as user, is then then turned on enterprises i.e.When communication software carry out employee between business exchange, the IP of the timely communication software server of that mail server, enterprisesAddress is exactly the purpose IP address that user mainly accesses.Obtaining the purpose IP address that user mainly accesses can be looked by databaseInquiry obtains, i.e., (5 purpose IP address before record strip number in such as database of the forward purpose IP address of record strip number in databaseIt is identified as the purpose IP address that user mainly accesses).
The network access time of record is counted, the purpose IP address that statistics enterprise staff mainly accesses mainly existsWhich accesses the period, and 8 are concentrated mainly on as the enterprise staff accesses the mail server time:30-9:30、17:00-18:00.Counting enterprise staff, main section at those times accesses network daily, such as mainly 8:30-10:00、16:00-18:00。
The network flow of record is counted, the flow for the purpose IP address that statistics enterprise staff accesses in one day is visitedAsk the purpose IP address of maximum flow, network flow of the statistics enterprise staff in one day in total.
The network access frequency of record is counted, statistics enterprise staff accesses time of a purpose IP address in one dayNumber.The number for accessing webmail service device in one day such as an enterprise staff is 10-20 times.
Information after analyzing, counting above is preserved, with the enterprise staff identification information, (such as enterprise staff logs in electricityThe user name of brain) it is index, it stores in information above to database.To obtain the network behavior rule number of the enterprise staffAccording to 8 as the enterprise staff:30-9:30 access enterprise's mailbox server, 10:00-10:30 access under archive serverPublished article shelves are handled, access the network flow of network daily between 2G-5G.
S103, using the enterprise staff network behavior information and enterprise staff network behavior rule recorded in a period of time intoRow compares, if the enterprise staff network behavior information and enterprise staff network behavior rule that are recorded in a period of time are variant,Then report the information of enterprise staff network behavior exception.
The enterprise staff network behavior information on the same day or current continuous a period of time (a such as week) record is dividedAnalyse and the enterprise staff that is obtained after summarizing on the day of or current continuous a period of time (a such as week) network behavior rule andThe web-based history Behavior law of the enterprise staff is compared, on the day of analyzing the enterprise staff by comparing or continuous one section currentWhether the network behavior of time (a such as week) and the network behavior rule of history have larger difference.Such as the enterprise staff existsCurrent continuous a period of time is all 17:00-18:00 just accesses mail server, and the network of the enterprise staff historical recordBehavior law is 8:30-9:30 access mail server, then it is assumed that the network behavior that the enterprise staff ought be for the previous period hasIt is abnormal, need the information for reporting enterprise staff network behavior exception to corresponding system or department (such as Human Resource Department).
Mainly the time of network, the purpose IP address mainly accessed, network flow etc. progress are accessed from enterprise staffCompare, if the network behavior rule difference of current these information and historical record is larger, needs to report enterprise staff netThe information of network abnormal behavior is to corresponding system or department (such as Human Resource Department).The enterprise staff network behavior exception information reportedIncluding the enterprise staff ought be for the previous period network behavior rule, enterprise staff mark (such as enterprise staff log in computer accountNumber).
After corresponding department receives enterprise staff network behavior exception information, corresponding measure can be taken.Such as with the employee intoRow exchange, understands the current state of the employee；Or it works together from the periphery of the employee and understands whether the employee has leaving office to be inclined to.
The present embodiment is sentenced in the difference by comparing enterprise staff current network Behavior law and web-based history Behavior lawWhether the disconnected enterprise staff has abnormal behaviour.It was found that after the enterprise staff has abnormal behaviour, it can exchange, keep away with the employeeExempt from the employee to leave office, to the enterprise efficiency of management.
Embodiment two
With reference to figure 4, the present embodiment increases following steps on the basis of embodiment one：
S104, the work plan for obtaining enterprise staff, if the work plan of enterprise staff and record in a period of timeEnterprise staff network behavior information match but variant with user network Behavior law, then do not report enterprise staff network behaviorAbnormal information.
Enterprise staff generally all can formulate a work plan in each season or every month, as some is added in some employeeAfter project team, need for the specified a work plan of the enterprise staff.Work plan includes the following contents：Job category, workContent, task intensity, plan duration.
After judging that the enterprise staff network behavior information and user network Behavior law that are recorded in a period of time are variant, obtainThe work plan for taking this period of time of the enterprise staff judges the enterprise staff interior note for a period of time by analyzing work planThe enterprise staff network behavior information of record is with the presence or absence of abnormal.If job category is software development, great work intensity, and the enterprise(network flow increases, visits for the enterprise staff network behavior information of record and the matching of these work plans in this period of time of employeeThe purpose IP address asked is more), then the information of the enterprise staff network behavior exception is not reported.
If enterprise staff network behavior information and these work plans that the enterprise staff records in this period of time are notMatching, then need the information for reporting the enterprise staff network behavior exception.If job category is flow tracking, working strength is small,And the enterprise staff network behavior information and these work plans that the enterprise staff records in this period of time mismatch (network flowAmount increases, the purpose IP address of access is more), then need the information for reporting the enterprise staff network behavior exception.
Enterprise staff work plan is imported, can be automatically imported by third party system (such as assessment of staff system).Third party systemSystem is automatically imported enterprise staff network behavior after enterprise staff or the People Leader submit the work plan of the enterprise staffIn analysis system.After downstream industry employee or the People Leader have modified the work plan of the enterprise staff, it is also desirable to same in real timeIt walks in enterprise staff user's behaviors analysis system.
The present embodiment imports enterprise staff work plan in enterprise staff user's behaviors analysis, is sentenced by work planDisconnected enterprise staff is abnormal with the presence or absence of network behavior, improves that the accuracy of judgement, the user experience is improved.
Embodiment three
With reference to figure 5, the present embodiment increases following steps on the basis of embodiment one：
S105, distinctive mark is arranged to some IP address；The purpose that network in enterprise staff network behavior information accessesWhen IP address includes the IP address provided with distinctive mark, the information of enterprise staff network behavior exception is reported.
Network administrator's purpose IP address sensitive to some is identified, such as to the IP address of recruitment website, competition pairThe web IP address of hand is identified.As long as enterprise staff network behavior information includes the IP address that these are provided with distinctive markWhen, report the information of enterprise staff network behavior exception.
Network administrator can be sensitive to these purpose IP address be identified and be further configured, enterprise person is setWork accesses sensitive purpose IP address and reaches certain number (accessing more than 10 times for such as one week) whithin a period of time (in such as one week)When, just report the information of enterprise staff network behavior exception.
Network administrator can be purpose IP address, the access times that independent sensitivity is arranged in each enterprise staff, i.e., oftenSensitive purpose IP address, the access times of a enterprise staff can be different, there is the independent parameter of oneself.
Sensitive purpose IP address is arranged in the present embodiment in enterprise staff user's behaviors analysis, and enterprise staff accesses theseReport network abnormal behavior when sensitive purpose IP address reaches certain number, improves the flexibility of judgement, improves userExperience.
Example IV
With reference to figure 6, the present embodiment increases following steps on the basis of embodiment one, including：
S106, browser label character or figure corresponding word when enterprise staff uses browser access network are obtained.
Enterprise staff needs to log in computer progress work disposal daily, after enterprise staff logs in computer, needs to access correspondingNetwork such as accesses internal lan or internet.Enterprise staff can generally use browser access Intranet or interconnectionNet understands relevent information or carries out corresponding service processing.
System record enterprise staff passes through browser label character when browser access network or the corresponding word of figure.It obtainsAfter taking these word contents, these word contents are saved in database, convenient for subsequently analyzing these word contents.Browser label character is usually the general introduction of Web content, by obtain enterprise staff access network when browser label character orThe corresponding word of figure, so that it may to know the content in terms of enterprise staff is primarily upon that, as enterprise staff mainly accesses enterpriseThe java technology contents of the technical forum of internal web site.
S107, the word of acquisition is summarized, is analyzed, obtained enterprise staff network and access content rule.
The enterprise staff of record is believed by browser label character when browser access network or the corresponding word of figureBreath is analyzed, and the related content that enterprise staff mainly accesses is obtained.As enterprise staff mainly accesses the skill of enterprises websiteThe java technology contents of art forum.
Information after analyzing, counting above is preserved, with the enterprise staff identification information, (such as enterprise staff logs in electricityThe user name of brain) it is index, it stores in information above to database.Network to obtain the enterprise staff accesses interior content regulationRule, 18 as the enterprise staff:30-20:30 access the java technology contents of the technical forum of enterprises website.
S108, content regulation in content and the access of enterprise staff network is accessed using the enterprise staff network recorded in a period of timeRule is compared, if the enterprise staff network recorded in a period of time accesses content and enterprise staff network accesses content ruleIt is variant, then report the information of enterprise staff network behavior exception.
Content is accessed to the enterprise staff network on the same day or current continuous a period of time (a such as week) record to divideThe network on the enterprise staff same day or current continuous a period of time (a such as week) analysing and obtained after summarizing accesses interior content regulationThe web-based history of rule and the enterprise staff accesses content rule and is compared, on the day of analyzing the enterprise staff by comparing or currentThe network of continuous a period of time (a such as week) accesses content rule and the network of history accesses whether content has larger differenceIt is different.Such as enterprise staff is all 18 in current continuous a period of time:30-20:30 access the technical forum of enterprises websiteBig data technology contents, and the Web content of the enterprise staff historical record access rule be 18:30-20:30 access enterpriseThe java technology contents of the technical forum of industry internal web site, then it is assumed that the network behavior that the enterprise staff ought be for the previous period has differentOften, need the information for reporting enterprise staff network behavior exception to corresponding system or department (such as Human Resource Department).
After corresponding department receives enterprise staff network behavior exception information, corresponding measure can be taken.Such as with the employee intoRow exchange, understands the current state of the employee；Or it works together from the periphery of the employee and understands whether the employee has leaving office to be inclined to.
The present embodiment is accessing content rule and web-based history access content rule by comparing enterprise staff current networkDifference, judge whether the enterprise staff has abnormal behaviour.It was found that after the enterprise staff has abnormal behaviour, can with the employee intoRow exchange, avoids the employee from leaving office, to the enterprise efficiency of management.
Embodiment five
With reference to figure 7, a kind of device of enterprise staff user's behaviors analysis, the device includes logging modle P201, analysis mouldBlock P202 and judgment module P203.
Logging modle P20, for recording enterprise staff network behavior information.
Enterprise staff needs to log in computer progress work disposal daily, after enterprise staff logs in computer, needs to access correspondingNetwork such as accesses internal lan or internet.Enterprise staff can all be received after generally going to work daily using e-mail client softwareSend out mail；Log in the business exchange between enterprises instant message applications progress enterprise staff；Browse internet, decorrelationInformation.
System records the relevant information that enterprise staff accesses network：The purpose IP address that network accesses, access time, accessDuration, network flow, network access frequency, enterprise staff mark.After obtaining these information, these information preservations to databaseIn, convenient for subsequently analyzing these information.
Network access purpose IP address obtained from network packet, as TCP, udp protocol data packet in obtain；It visitsAsk that the time is that enterprise staff accesses the purpose IP address time started；A length of enterprise staff accesses the purpose IP address when accessDuration, while adding up the enterprise staff accesses network total duration in one day；Network flow accesses for enterprise staff in one day shouldThe network flow of purpose IP address, while adding up the enterprise staff accesses all-network total flow in one day；Access networkFrequency is that enterprise staff accesses some websites or the number of network address in one day；Enterprise staff is identified as the user that user logs in computerThe computer title that name or employee use.
The relevant information that enterprise staff accesses network is recorded, after local data library storage, is also sent to third party's clothesBusiness device is stored, and compiling third-party server is unified to analyze the network behavior of enterprise staff.
Analysis module P202 obtains user network behavior for being summarized to enterprise staff network behavior information, being analyzedRule.
The enterprise staff network information of record is analyzed, purpose IP address (such as user that user mainly accesses is obtained5 IP address informations before the destination IP of access, the purpose IP address that general enterprises employee mainly accesses are strong with oneself workRelevant server).It is first turned on Mail Clients receiving and dispatching mail after going to work daily such as user, is then then turned on enterprises i.e.When communication software carry out employee between business exchange, the IP of the timely communication software server of that mail server, enterprisesAddress is exactly the purpose IP address that user mainly accesses.Obtaining the purpose IP address that user mainly accesses can be looked by databaseInquiry obtains, i.e., (5 purpose IP address before record strip number in such as database of the forward purpose IP address of record strip number in databaseIt is identified as the purpose IP address that user mainly accesses).
The network access time of record is counted, the purpose IP address that statistics enterprise staff mainly accesses mainly existsWhich accesses the period, and 8 are concentrated mainly on as the enterprise staff accesses the mail server time:30-9:30、17:00-18:00.Counting enterprise staff, main section at those times accesses network daily, such as mainly 8:30-10:00、16:00-18:00。
The network flow of record is counted, the flow for the purpose IP address that statistics enterprise staff accesses in one day is visitedAsk the purpose IP address of maximum flow, network flow of the statistics enterprise staff in one day in total.
The network access frequency of record is counted, statistics enterprise staff accesses time of a purpose IP address in one dayNumber.The number for accessing webmail service device in one day such as an enterprise staff is 10-20 times.
Information after analyzing, counting above is preserved, with the enterprise staff identification information, (such as enterprise staff logs in electricityThe user name of brain) it is index, it stores in information above to database.To obtain the network behavior rule number of the enterprise staffAccording to 8 as the enterprise staff:30-9:30 access enterprise's mailbox server, 10:00-10:30 access under archive serverPublished article shelves are handled, access the network flow of network daily between 2G-5G.
Judgment module P203, for using the enterprise staff network behavior information and user network row recorded in a period of timeIt is compared for rule, if the enterprise staff network behavior information and user network Behavior law that are recorded in a period of time have differenceIt is different, then report the information of enterprise staff network behavior exception.
The enterprise staff network behavior information on the same day or current continuous a period of time (a such as week) record is dividedAnalyse and the enterprise staff that is obtained after summarizing on the day of or current continuous a period of time (a such as week) network behavior rule andThe web-based history Behavior law of the enterprise staff is compared, on the day of analyzing the enterprise staff by comparing or continuous one section currentWhether the network behavior of time (a such as week) and the network behavior rule of history have larger difference.Such as the enterprise staff existsCurrent continuous a period of time is all 17:00-18:00 just accesses mail server, and the network of the enterprise staff historical recordBehavior law is 8:30-9:30 access mail server, then it is assumed that the network behavior that the enterprise staff ought be for the previous period hasIt is abnormal, need the information for reporting enterprise staff network behavior exception to corresponding system or department (such as Human Resource Department).
Mainly the time of network, the purpose IP address mainly accessed, network flow etc. progress are accessed from enterprise staffCompare, if the network behavior rule difference of current these information and historical record is larger, needs to report enterprise staff netThe information of network abnormal behavior is to corresponding system or department (such as Human Resource Department).The enterprise staff network behavior exception information reportedIncluding the enterprise staff ought be for the previous period network behavior rule, enterprise staff mark (such as enterprise staff log in computer accountNumber).
After corresponding department receives enterprise staff network behavior exception information, corresponding measure can be taken.Such as with the employee intoRow exchange, understands the current state of the employee；Or it works together from the periphery of the employee and understands whether the employee has leaving office to be inclined to.
The present embodiment is sentenced in the difference by comparing enterprise staff current network Behavior law and web-based history Behavior lawWhether the disconnected enterprise staff has abnormal behaviour.It was found that after the enterprise staff has abnormal behaviour, it can exchange, keep away with the employeeExempt from the employee to leave office, to the enterprise efficiency of management.
Embodiment six
On the basis of embodiment five, judgment module P203 is additionally operable to obtain the work plan of enterprise staff the present embodiment,If the work plan of enterprise staff and the enterprise staff network behavior information match recorded in a period of time but and user networkNetwork Behavior law is variant, then does not report the information of enterprise staff network behavior exception.
Enterprise staff generally all can formulate a work plan in each season or every month, as some is added in some employeeAfter project team, need for the specified a work plan of the enterprise staff.Work plan includes the following contents：Job category, workContent, task intensity, plan duration.
After judging that the enterprise staff network behavior information and user network Behavior law that are recorded in a period of time are variant, obtainThe work plan for taking this period of time of the enterprise staff judges the enterprise staff interior note for a period of time by analyzing work planThe enterprise staff network behavior information of record is with the presence or absence of abnormal.If job category is software development, great work intensity, and the enterprise(network flow increases, visits for the enterprise staff network behavior information of record and the matching of these work plans in this period of time of employeeThe purpose IP address asked is more), then the information of the enterprise staff network behavior exception is not reported.
If enterprise staff network behavior information and these work plans that the enterprise staff records in this period of time are notMatching, then need the information for reporting the enterprise staff network behavior exception.If job category is flow tracking, working strength is small,And the enterprise staff network behavior information and these work plans that the enterprise staff records in this period of time mismatch (network flowAmount increases, the purpose IP address of access is more), then need the information for reporting the enterprise staff network behavior exception.
Enterprise staff work plan is imported, can be automatically imported by third party system (such as assessment of staff system).Third party systemSystem is automatically imported enterprise staff network behavior after enterprise staff or the People Leader submit the work plan of the enterprise staffIn analysis system.After downstream industry employee or the People Leader have modified the work plan of the enterprise staff, it is also desirable to same in real timeIt walks in enterprise staff user's behaviors analysis system.
The present embodiment imports enterprise staff work plan in enterprise staff user's behaviors analysis, is sentenced by work planDisconnected enterprise staff is abnormal with the presence or absence of network behavior, improves that the accuracy of judgement, the user experience is improved.
Embodiment seven
On the basis of embodiment five, judgment module P203 is additionally operable to that special mark is arranged to some IP address the present embodimentWill；When the purpose IP address that network in enterprise staff network behavior information accesses includes the IP address provided with distinctive mark,Report the information of enterprise staff network behavior exception.
Network administrator's purpose IP address sensitive to some is identified, such as to the IP address of recruitment website, competition pairThe web IP address of hand is identified.As long as enterprise staff network behavior information includes the IP address that these are provided with distinctive markWhen, report the information of enterprise staff network behavior exception.
Network administrator can be sensitive to these purpose IP address be identified and be further configured, enterprise person is setWork accesses sensitive purpose IP address and reaches certain number (accessing more than 10 times for such as one week) whithin a period of time (in such as one week)When, just report the information of enterprise staff network behavior exception.
Network administrator can be purpose IP address, the access times that independent sensitivity is arranged in each enterprise staff, i.e., oftenSensitive purpose IP address, the access times of a enterprise staff can be different, there is the independent parameter of oneself.
Sensitive purpose IP address is arranged in the present embodiment in enterprise staff user's behaviors analysis, and enterprise staff accesses theseReport network abnormal behavior when sensitive purpose IP address reaches certain number, improves the flexibility of judgement, improves userExperience.
Embodiment eight
The present embodiment is on the basis of embodiment five, logging modle P20, is additionally operable to acquisition enterprise staff and is visited using browserBrowser label character or figure corresponding word when asking network.
Enterprise staff needs to log in computer progress work disposal daily, after enterprise staff logs in computer, needs to access correspondingNetwork such as accesses internal lan or internet.Enterprise staff can generally use browser access Intranet or interconnectionNet understands relevent information or carries out corresponding service processing.
System record enterprise staff passes through browser label character when browser access network or the corresponding word of figure.It obtainsAfter taking these word contents, these word contents are saved in database, convenient for subsequently analyzing these word contents.Browser label character is usually the general introduction of Web content, by obtain enterprise staff access network when browser label character orThe corresponding word of figure, so that it may to know the content in terms of enterprise staff is primarily upon that, as enterprise staff mainly accesses enterpriseThe java technology contents of the technical forum of internal web site.
Analysis module P202 is additionally operable to summarize the word of acquisition, analyze, and obtains enterprise staff network and accesses contentRule.
The enterprise staff of record is believed by browser label character when browser access network or the corresponding word of figureBreath is analyzed, and the related content that enterprise staff mainly accesses is obtained.As enterprise staff mainly accesses the skill of enterprises websiteThe java technology contents of art forum.
Information after analyzing, counting above is preserved, with the enterprise staff identification information, (such as enterprise staff logs in electricityThe user name of brain) it is index, it stores in information above to database.Network to obtain the enterprise staff accesses interior content regulationRule, 18 as the enterprise staff:30-20:30 access the java technology contents of the technical forum of enterprises website.
Judgment module P203 is also used for the enterprise staff network recorded in a period of time and accesses content and enterprise staffNetwork accesses content rule and is compared, if the enterprise staff network recorded in a period of time accesses content and enterprise staff netNetwork access content rule is variant, then reports the information of enterprise staff network behavior exception.
Content is accessed to the enterprise staff network on the same day or current continuous a period of time (a such as week) record to divideThe network on the enterprise staff same day or current continuous a period of time (a such as week) analysing and obtained after summarizing accesses interior content regulationThe web-based history of rule and the enterprise staff accesses content rule and is compared, on the day of analyzing the enterprise staff by comparing or currentThe network of continuous a period of time (a such as week) accesses content rule and the network of history accesses whether content has larger differenceIt is different.Such as enterprise staff is all 18 in current continuous a period of time:30-20:30 access the technical forum of enterprises websiteBig data technology contents, and the Web content of the enterprise staff historical record access rule be 18:30-20:30 access enterpriseThe java technology contents of the technical forum of industry internal web site, then it is assumed that the network behavior that the enterprise staff ought be for the previous period has differentOften, need the information for reporting enterprise staff network behavior exception to corresponding system or department (such as Human Resource Department).
After corresponding department receives enterprise staff network behavior exception information, corresponding measure can be taken.Such as with the employee intoRow exchange, understands the current state of the employee；Or it works together from the periphery of the employee and understands whether the employee has leaving office to be inclined to.
The present embodiment is accessing content rule and web-based history access content rule by comparing enterprise staff current networkDifference, judge whether the enterprise staff has abnormal behaviour.It was found that after the enterprise staff has abnormal behaviour, can with the employee intoRow exchange, avoids the employee from leaving office, to the enterprise efficiency of management.
It should be noted that herein, the terms "include", "comprise" or its any other variant are intended to non-rowHis property includes, so that process, method, article or device including a series of elements include not only those elements, andAnd further include other elements that are not explicitly listed, or further include for this process, method, article or device institute it is intrinsicElement.In the absence of more restrictions, the element limited by sentence "including a ...", it is not excluded that including thisThere is also other identical elements in the process of element, method, article or device.
The embodiments of the present invention are for illustration only, can not represent the quality of embodiment.
Through the above description of the embodiments, those skilled in the art can be understood that above-described embodiment sideMethod can add the mode of required general hardware platform to realize by software, naturally it is also possible to by hardware, but in many casesThe former is more preferably embodiment.Based on this understanding, technical scheme of the present invention substantially in other words does the prior artGoing out the part of contribution can be expressed in the form of software products, which is stored in a storage mediumIn (such as ROM/RAM, magnetic disc, CD), including some instructions are used so that a station terminal (can be mobile phone, computer, serviceDevice, air conditioner or network equipment etc.) execute method described in each embodiment of the present invention.
The embodiment of the present invention is described with above attached drawing, but the invention is not limited in above-mentioned specificEmbodiment, the above mentioned embodiment is only schematical, rather than restrictive, those skilled in the artUnder the inspiration of the present invention, without breaking away from the scope protected by the purposes and claims of the present invention, it can also make very muchForm, all of these belong to the protection of the present invention.