Abstract: A method and device for monitoring virus trend abnormality are provided which may enable timely and effective monitoring of computer viruses. The method may include measuring a frequency of hits of a virus being found and/or removed. The frequency may be used for calculating an M-day moving average value of the number of hits of the virus. Method may also involve calculating a standardized residual of the number of hits of the virus. When the standardized residual is larger than a first preset threshold, the time at which the virus was encounter the last may be identified as an abnormality point on a trendline of the virus.

Abstract: A method and device for processing data in the field of data process are disclosed. The method includes: sorting samples according to primary keys, wherein the primary key includes a feature serial number and a sample serial number, and wherein a column value corresponding to the primary key is used as a feature value for the sample; acquiring a statistic of each feature in each category by taking the primary key and the feature value as an input key-value pair and calculating with a first algorithm model, and outputting the feature serial number and the statistic as an output key-value pair; and acquiring a contribution value of each feature to the category by performing calculation on the output key-value pair with a second algorithm model, and selecting a feature based on the contribution value. The device includes a sorting module, a first processing module and a second processing module.

Abstract: A data processing method is provided, which includes: performing a fingerprint calculation for each data element of a set of data elements to obtain fingerprint information of the data elements; grouping the data elements into data groups in accordance with the fingerprint information, including by grouping data elements with the same fingerprint information into a same data group; and selecting a particular data element from each of the data groups for modeling calculation. A corresponding device is described. With the technical solutions according to the present method, data processing amount for modeling calculation may be reduced, which may thereby reduce data processing time and improve the data processing efficiency.

Abstract: A method and device for monitoring virus trend abnormality are provided which may enable timely and effective monitoring of computer viruses. The method may include measuring a frequency of hits of a virus being found and/or removed. The frequency may be used for calculating an M-day moving average value of the number of hits of the virus. Method may also involve calculating a standardized residual of the number of hits of the virus. When the standardized residual is larger than a first preset threshold, the time at which the virus was encounter the last may be identified as an abnormality point on a trendline of the virus.