Risk early warning method and device, computer equipment, storage medium and program product

Abstract

The invention relates to the technical field of cloud security, in particular to a risk early warning method and device, computer equipment, a storage medium and a program product. The method comprises the following steps: acquiring system information of a target system, wherein the system information comprises state data of each node; calling a risk identification model to process the system information to obtain a risk identification result for the target system output by the risk identification model; the risk identification result comprises the probability that each risk type may occur; wherein the risk identification model is obtained by training based on a training sample, the training sample is constructed based on each historical risk event of the target system, and the historical risk event comprises system information corresponding to the target system at a historical fault moment and a state of each corresponding risk type; and updating a risk trend chart of the target system based on the risk identification result, and sending the updated risk trend chart to the target device. By adopting the method provided by the invention, the accuracy of risk early warning of the whole cloud service can be improved.

Description

Technical Field

[0001] The present application relates to the field of cloud security technology, and in particular to a risk warning method, device, computer equipment, storage medium and program product. Background Art

[0002] With the development of cloud computing technology, various cloud computing-based services are constantly updated; as enterprises pay close attention to security incidents, the operation and maintenance management of various services becomes particularly important.

[0003] Taking the current mainstream SaaS (Software as a Service) cloud service as an example, the SaaS cloud service log processing solution in related technologies usually adopts a centralized approach to log processing, determines whether there is a fault through preset rules, and performs monitoring and alarm; among them, the centralized approach is that each module only independently monitors and analyzes the data of each module itself or the data of a specific protection point, so as to issue a fault reminder for each module.

[0004] However, SaaS services often have complex and diverse docking systems and logs. With the continuous addition of docking systems and applications such as cluster deployment, the entire cloud service will have various failures and risks. In addition, due to the hardware connection or data interaction between modules, the failure of a module may not be caused by the module itself. In other words, the relevant technology ignores the connection between the various modules of the system, resulting in inaccurate risk analysis results for each module.

[0005] Therefore, how to improve the accuracy of risk warning for cloud services as a whole is an issue that needs to be addressed urgently. Summary of the invention

[0006] Based on this, it is necessary to provide a risk warning method, device, computer equipment, storage medium and program product that can improve the accuracy of risk warning for the entire cloud service in response to the above technical problems.

[0007] In a first aspect, the present application provides a risk early warning method, comprising:

[0008] Acquire system information of the target system, wherein the system information includes status data of each node;

[0009] Calling a risk identification model to process the system information, and obtaining a risk identification result for the target system output by the risk identification model; the risk identification result includes the probability of each risk type occurring; wherein the risk identification model is obtained by training based on training samples, and the training samples are constructed based on various historical risk events of the target system, and the historical risk events include the system information corresponding to the target system at the time of historical failure, and the corresponding status of each risk type;

[0010] Based on the risk identification result, the risk trend map of the target system is updated, and the updated risk trend map is sent to the target device.

[0011] In one embodiment, the risk identification model training process includes:

[0012] Acquire a plurality of the historical risk events of the target system, and analyze each of the historical risk events to determine an associated node corresponding to each risk type;

[0013] For each of the risk types, based on the associated nodes corresponding to the risk type, determine the risk factor of the risk type in each of the historical risk events;

[0014] constructing the training sample for the risk factor of the risk type in each of the historical risk events and the state of the risk type;

[0015] The initial model is trained based on each of the training samples to obtain the risk identification model.

[0016] In one embodiment, the parsing of each of the historical risk events to obtain a correlation node corresponding to each of the risk types includes:

[0017] For each of the risk types, each of the historical risk events is used as source data, and the correlation between the risk type and each of the nodes is determined from the source data;

[0018] Based on the correlation, the associated node corresponding to the risk type is determined.

[0019] In one embodiment, the step of constructing the training sample for the risk factor of the risk type and the state of the risk type in each of the historical risk events includes:

[0020] Based on the correlation, weighting the risk factor corresponding to the risk type;

[0021] The weighted risk factor is used as sample data, and the state of the risk type is used as a sample label to construct a training sample.

[0022] In one embodiment, the training of the initial model based on each of the training samples to obtain the risk identification model includes:

[0023] Dividing each of the training samples to obtain a training set and a test set;

[0024] Training the initial model based on the training set, and testing the trained initial model based on the test set to obtain a test result;

[0025] If the test result meets the preset conditions, the trained initial model is determined to be the risk identification model.

[0026] In one embodiment, the method further comprises:

[0027] Based on the risk identification result, determining a weight corresponding to each of the risk types from a mapping table, wherein the mapping table includes a correspondence between a probability of occurrence of each of the risk types and a weight;

[0028] Based on the weight corresponding to each of the risk types, a performance evaluation for the target system is determined.

[0029] In a second aspect, the present application also provides a risk warning device, which includes an information acquisition module, a model processing module and an update module, wherein:

[0030] An information acquisition module is used to acquire system information of the target system, wherein the system information includes status data of each node;

[0031] A model processing module, used for invoking a risk identification model to process the system information, and obtaining a risk identification result output by the risk identification model for the target system; the risk identification result includes the probability of each risk type occurring; wherein the risk identification model is obtained by training based on training samples, and the training samples are constructed based on various historical risk events of the target system, and the historical risk events include the system information corresponding to the target system at the time of historical failure, and the corresponding status of each risk type;

[0032] An updating module is used to update the risk trend map of the target system based on the risk identification result, and send the updated risk trend map to the target device.

[0033] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0034] Acquire system information of the target system, wherein the system information includes status data of each node;

[0035] Calling a risk identification model to process the system information, and obtaining a risk identification result for the target system output by the risk identification model; the risk identification result includes the probability of each risk type occurring; wherein the risk identification model is obtained by training based on training samples, and the training samples are constructed based on various historical risk events of the target system, and the historical risk events include the system information corresponding to the target system at the time of historical failure, and the corresponding status of each risk type;

[0036] Based on the risk identification result, the risk trend map of the target system is updated, and the updated risk trend map is sent to the target device.

[0037] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0038] Acquire system information of the target system, wherein the system information includes status data of each node;

[0039] Calling a risk identification model to process the system information, and obtaining a risk identification result for the target system output by the risk identification model; the risk identification result includes the probability of each risk type occurring; wherein the risk identification model is obtained by training based on training samples, and the training samples are constructed based on various historical risk events of the target system, and the historical risk events include the system information corresponding to the target system at the time of historical failure, and the corresponding status of each risk type;

[0040] Based on the risk identification result, the risk trend map of the target system is updated, and the updated risk trend map is sent to the target device.

[0041] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0042] Acquire system information of the target system, wherein the system information includes status data of each node;

[0043] Calling a risk identification model to process the system information, and obtaining a risk identification result for the target system output by the risk identification model; the risk identification result includes the probability of each risk type occurring; wherein the risk identification model is obtained by training based on training samples, and the training samples are constructed based on various historical risk events of the target system, and the historical risk events include the system information corresponding to the target system at the time of historical failure, and the corresponding status of each risk type;

[0044] Based on the risk identification result, the risk trend map of the target system is updated, and the updated risk trend map is sent to the target device.

[0045] The above-mentioned risk warning method, device, computer equipment, storage medium and program product train the risk identification model through training samples constructed by various historical failure events of the target system. Since each historical failure event includes the status data of each node of the target system at the corresponding failure time, as well as the status of each corresponding risk type; that is to say, the trained risk identification model has the ability to analyze the possible risks of the target system from the overall dimension of each node; therefore, the system information of the acquired target system is input into the risk identification model, and a risk identification result including the probability of each risk type can be obtained, thereby improving the accuracy of the overall risk identification of the target system; and further, the risk identification result is used to update the risk trend map of the target system, and the updated risk trend map is sent to the target device, so that the operation and maintenance personnel can more clearly and intuitively understand the risk change trend of the target system, so as to better prepare for the risk. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0047] Figure 1 A schematic diagram of a risk warning method in one embodiment;

[0048] Figure 2 A schematic diagram of a process for training a risk identification model in one embodiment;

[0049] Figure 3 A schematic diagram of a flow chart of steps for determining an associated node in one embodiment;

[0050] Figure 4A schematic diagram of a process of constructing a training sample in one embodiment;

[0051] Figure 5 An example diagram of a data structure of historical risk events in one embodiment;

[0052] Figure 6 A schematic diagram of a process for determining a performance evaluation in one embodiment;

[0053] Figure 7 A schematic diagram of a process of a risk early warning method in another embodiment;

[0054] Figure 8 A schematic diagram of a flow chart of reading a log in another embodiment;

[0055] Fig. 9 A schematic diagram of a process for building a prediction model in another embodiment;

[0056] Fig.10 A schematic diagram of a process for determining a risk level in another embodiment;

[0057] Fig.11 is a structural block diagram of a risk warning device in an embodiment;

[0058] Fig.12 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0059] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0060] The risk warning method provided in the embodiment of the present application is executed by a computer device, wherein the computer device may be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, Internet of Things devices and portable wearable devices, and the Internet of Things devices may be smart speakers, smart TVs, smart air conditioners, smart car-mounted devices, etc. Portable wearable devices may be smart watches, smart bracelets, head-mounted devices, etc.; the server may be implemented as an independent server or a server cluster composed of multiple servers. Furthermore, the target system may be configured on a computer device that executes the risk warning method of the embodiment of the present application, or may be configured on other computer devices, and the present application does not specifically limit this.

[0061] In an exemplary embodiment, Figure 1 As shown, a risk early warning method is provided, which specifically includes the following steps 10 to 30, wherein:

[0062] Step 10: Obtain system information of the target system, where the system information includes status data of each node.

[0063] For the embodiments of the present application, the system information of the target system is obtained by the data collection component; a probe is pre-inserted into each node (engine) of the target system, and the probe is used to collect historical status data and / or real-time status data of the corresponding node; each probe is pre-configured to be able to communicate with the data collection component, so that the computing device can obtain the status data of each node of the target system through the data collection component.

[0064] Furthermore, the computer device can obtain system information of the target system in real time, or obtain system information of the target system based on a set collection frequency, or obtain system information of the target system when receiving an acquisition instruction triggered by a user; the frequency and conditions for obtaining system information are not specifically limited in the embodiments of the present application.

[0065] Step 20: Call the risk identification model to process the system information and obtain the risk identification result for the target system output by the risk identification model; the risk identification result includes the probability of each risk type occurring.

[0066] For the embodiment of the present application, the risk identification model is trained based on training samples, and the training samples are constructed based on various historical risk events of the target system. The historical risk events include the system information corresponding to the target system at the time of historical failures, and the corresponding status of each risk type. In other words, the risk identification model obtained by training can predict the probability of each risk type occurring in the target system based on the real-time system information of the target system. Therefore, after obtaining the real-time system information of the target system, the real-time system information is input into the risk identification model to obtain the risk identification result output by the risk identification model. In an example, if there are three types of risks in the system, namely A, B and C, then a possible risk identification result is: risk type A-30%, risk type B-70%, risk type C-50%.

[0067] Among them, the system information may specifically include the status data of device nodes, the status data of service nodes, and the data of port nodes; the status data of device nodes may include the CPU (Central Processing Unit) occupancy rate, memory usage rate, network rate, device temperature and other data of each device; the status data of service nodes may include the number of real-time task processing, the number of logs generated, and the number of tasks to be processed; the status data of port nodes may include the communication frequency between ports and the port occupancy rate and other data. The status data of each type of node is not limited to the types listed in the embodiments of the present application, and may also include other more detailed data, which shall be subject to the actual business needs and is not specifically limited in the embodiments of the present application.

[0068] Furthermore, in subsequent embodiments, the specific composition of historical fault events and the process of constructing training samples based on each historical fault event will be described in more detail, which will not be elaborated here.

[0069] Step 30: Based on the risk identification result, update the risk trend map of the target system, and send the updated risk trend map to the target device.

[0070] For the embodiment of the present application, the risk identification results outputted by the risk identification model each time are used to generate a risk trend graph, which characterizes the fluctuation of the probability of each risk type appearing in the target system. The type of the risk trend graph is not specifically limited in the embodiment of the present application. After the risk identification results for the target system are generated based on the real-time system information of the target system, the risk trend graph after the last update is updated based on the risk identification results, thereby obtaining the latest risk trend graph for the target system; the updated risk trend graph is sent to the target device, so that the operation and maintenance personnel of the target system can more intuitively control the overall risk trend of the target system.

[0071] Since there are hardware connections or data interactions between modules, the failure of a module may not be caused by the module itself. However, in the related art, each module of the target system is monitored independently, so that the risk analysis results for each module are made based on the module data of each module; that is, the related art ignores the connection between the modules of the system, resulting in inaccurate risk analysis results for each module.

[0072] In the above fault identification method, the risk identification model is trained by training samples constructed through various historical fault events of the target system. Since each historical fault event includes the status data of each node of the target system at the corresponding fault time, as well as the status of each corresponding risk type; that is to say, the trained risk identification model has the ability to analyze the possible risks of the target system from the overall dimension of each node; therefore, by inputting the acquired system information of the target system into the risk identification model, a risk identification result including the probability of each risk type occurring can be obtained, thereby improving the accuracy of the overall risk identification of the target system; and further, the risk identification result is used to update the risk trend graph of the target system, and the updated risk trend graph is sent to the target device, so that the operation and maintenance personnel can more clearly and intuitively understand the risk change trend of the target system, so as to better prepare for the risk.

[0073] In one embodiment, referring to Figure 2 The training process of the risk identification model may specifically include steps 01 to 04, wherein:

[0074] Step 01: Obtain multiple historical risk events of the target system, analyze each historical risk event, and determine the associated nodes corresponding to each risk type.

[0075] Specifically, the multiple historical risk events obtained are first preprocessed, and the preprocessing is normalization or unique hot encoding processing, so that the dimensions of each type of status data are unified, thereby improving the convenience and effectiveness of subsequent analysis. Then, the preprocessed historical risk events are analyzed to determine the associated nodes corresponding to each risk type. For each risk type, it is necessary to determine the key data type corresponding to the risk type; that is, to analyze each risk event, that is, to determine the key nodes corresponding to each risk type, where each key node represents a data type.

[0076] Step 02: For each risk type, based on the associated nodes corresponding to the risk type, determine the risk factor of the risk type in each historical risk event;

[0077] Step 03: Construct training samples for the risk factors and risk type status of the risk type in each historical risk event.

[0078] Specifically, after determining the key nodes corresponding to each risk type, corresponding to a risk type, based on the key nodes corresponding to the risk type, the data corresponding to the risk type is extracted from each historical risk event as a risk factor. For example, in a possible example, a historical risk event Q1 includes data of 6 nodes, namely Aa, Bb, Cc, Dd, Ee and Ff, wherein the capital letter AF represents the type of the node, and the lowercase letter af represents the state data corresponding to the node. For example, for a risk type S1, if it is determined that the key nodes corresponding to the risk type S1 are A, E and F, the risk factor data obtained from the historical risk event Q1 based on the risk type S1 are Aa, Ee and Ff, wherein the data of each node Aa, Ee and Ff are each used as a risk factor.

[0079] Then, further, the risk factors corresponding to a risk type in a historical risk event and the state of the risk type in the historical risk are used as a training sample. The state of the risk type can be 1 or 0; 1 indicates that the risk type has occurred, and 0 indicates that the risk type has not occurred.

[0080] The number of risk types in each historical risk event is the same, and these risk types represent all types of risks that may occur in the target system; however, the status of each risk type in each historical risk event is not necessarily the same. In other words, for each historical risk event, the number of training samples that can be generated is the same as the number of risk types. For example, if each historical risk event corresponds to the status of 5 risk types, then each historical risk event can generate 5 training samples, that is, each risk type can generate a training sample in each historical risk event. The total number of training samples is ,but ,in, is the number of risk types, is the number of historical risk events.

[0081] Step 04: Train the initial model based on each training sample to obtain a risk identification model.

[0082] Further, the initial model is trained using the training samples constructed in steps 01-03 to obtain a risk identification model. The initial model may be a multiple linear regression model, or other types of network models. The type of the initial model is not specifically limited in the embodiments of the present application.

[0083] The above content describes the process of training a risk identification model. The following content further describes how to determine the associated nodes corresponding to each risk type and how to construct a training sample.

[0084] Further, in one embodiment, referring to Figure 3 In step 01, the process of determining the associated nodes corresponding to each risk type may specifically include steps 011 and 012, wherein:

[0085] Step 011: For each risk type, use each historical risk event as source data, and determine the correlation between the risk type and each node from the source data;

[0086] Step 012: Based on the correlation, determine the associated node corresponding to the risk type.

[0087] Specifically, the correlation characterizes the contribution of the node type to the risk corresponding to the risk type. In an embodiment of the present application, the Pearson correlation coefficient between each risk type and each node type is determined from the source data, wherein the Pearson correlation coefficient between the risk type and the node type is the correlation between the two.

[0088] Among them, the Pearson correlation coefficient between the target risk type and the target node type can be determined by formula (1).

[0089] in, Formula (1); each historical risk event is To perform non-repeating numbering, For the In each historical risk event, the status data corresponding to the target node type is It is the average value of the status data corresponding to the target type node in each historical risk event; For the The status of the target risk type in the historical risk events, It is the average value of the status of the target risk type in each historical risk event.

[0090] Furthermore, for each risk type, the correlation between the risk type and each node type is determined by formula (1); then the node types are arranged in descending order of correlation, and the top N% of node types are selected as the corresponding associated nodes of the risk type. Among them, if the value corresponding to N% is not an integer, it is rounded up. Then, the associated nodes corresponding to each risk type can be determined by the above method. In one possible implementation method, N can be 30; however, for different systems, the value of N may be different, and the specific value of N is not limited in the embodiments of the present application.

[0091] Since the associated nodes corresponding to each risk type are determined from the historical risk events of the target system, that is to say, the key nodes corresponding to each risk type characterize the characteristics of the target system. In one example, there are three associated nodes corresponding to downtime risk, namely CPU occupancy, content usage, and log generation; among them, the CPU occupancy node type has the highest correlation with the downtime risk type, and the log generation node type has the lowest correlation with the downtime risk type.

[0092] Further, refer to Figure 4 In step 03, the process of constructing training samples may specifically include step 031 and step 032, wherein:

[0093] Step 031: weighting the risk factors corresponding to the risk types based on the correlation;

[0094] Step 032: Use the weighted risk factor as sample data and the state of the risk type as a sample label to construct a training sample.

[0095] Specifically, for each risk type, based on the associated nodes corresponding to the risk type, the state data corresponding to each associated node is extracted from each historical risk event, and each state data is used as a risk factor; then each risk factor corresponding to the risk type in the historical risk event is used as a set of sample data, and then the state corresponding to the risk type in the historical risk event is used as a sample label, and then the sample data and the sample label are constructed into a set of training samples. Among them, each risk factor in the sample data is assigned a weight based on the correlation between the node type corresponding to the risk factor and the risk type, wherein the higher the correlation, the greater the weight assigned; however, the relationship between the correlation and the weight ratio is not specifically limited in the embodiment of the present application.

[0096] In one example, if Figure 5 As shown, there is Historical risk events, each of which includes status data of 6 node types AF, and corresponds to the status of 4 risk types S, P, K and T. Assume that the associated nodes corresponding to risk type S are A, B and C, then the risk factors corresponding to risk type S in historical risk event 1 are a1, b1 and c1; the risk factors corresponding to risk type S in historical risk event n are an, bn and cn. Further, based on the correlation between nodes A, B and C and risk type S, the risk factors corresponding to each node type are weighted. For example, the weights corresponding to A, B and C and S are 0.5, 0.3 and 0.2 respectively; then 0.5a1, 0.3b1 and 0.2c1 are used as sample data, and the state 1 corresponding to S in the historical risk event is used as the sample label to construct a training sample of risk type S for historical risk event 1; then 0.5an, 0.3bn and 0.2cn are used as sample data, and the state 1 corresponding to S in the historical risk event n is used as the sample label to construct a training sample of risk type S for historical risk event n.

[0097] If the state of the risk type in the training sample indicates that the risk type occurs, then the training sample is a positive sample; if the state of the risk type in the training sample indicates that the risk type does not occur, then the training sample is a negative sample.

[0098] The above steps 011 and 012 as well as steps 031 and 032 further elaborate on the process of how to determine the associated nodes corresponding to each risk type and how to construct a training sample.

[0099] In the embodiment of the present application, the training samples constructed by steps 01-03 are divided to obtain a test set and a training set, and then the initial model is trained based on the training set, and the trained initial model is tested based on the test set to obtain a test result; if the test result meets the preset conditions, the trained initial model is determined to be a risk identification model. The ratio of the test set to the training set is not specifically limited in the embodiment of the present application. In one possible implementation method, the ratio of the training set to the test set is 7:3.

[0100] Specifically, in the embodiment of the present application, the loss function of the initial model is formula (2).

[0101] , formula (2). Among them, is the total number of training samples in the training set; the predicted risk value The initial model is The state of risk type predicted by the sample data of training samples, the actual risk value It is The state of risk types in training samples; among them, . Furthermore, the training result may be a changing trend of the loss function or a value of the loss function. Wherein, when the types corresponding to the training results are different, the preset conditions are also different; that is, each type of training result corresponds to a preset condition. For example, when the training result is the value of the loss function, the preset condition may be that the value of the loss function is less than the determination coefficient, where the determination coefficient may be set by the user, and this is not specifically limited in the embodiments of the present application.

[0102] In one embodiment of the present application, in order to better describe the overall performance of the target system, the present embodiment also includes steps 40 and 50, referring to Figure 6 ,in:

[0103] Step 40: Based on the risk identification result, determine the weight corresponding to each risk type from a mapping table, where the mapping table includes a correspondence between the probability of each risk type occurring and the weight;

[0104] Step 50: Determine the performance evaluation for the target system based on the weight corresponding to each risk type.

[0105] Specifically, the probability of each risk type occurring is divided into intervals to obtain a plurality of continuous probability intervals corresponding to each risk type, and each probability interval represents the severity corresponding to the risk type, that is, represents the level of the risk type. The mapping table contains the weights corresponding to each probability interval of each risk type. After obtaining the risk identification result output by the risk identification model, for each risk type, determine the target probability interval corresponding to the probability of the risk identification type occurring; then call the mapping table, and obtain the weight corresponding to each risk type in the risk identification result from the mapping table, and then multiply the probability of each risk type occurring by its corresponding weight, and then multiply the probabilities of all risk types occurring by their corresponding weights and add them up to obtain the performance evaluation of the target system. Among them, the correspondence between the probability of each risk type occurring and the weight is not specifically limited in the embodiments of the present application.

[0106] In the above technical solution, by updating the risk trend graph of the target system, the operation and maintenance personnel can intuitively understand the probability and change trend of each risk type in the target system; and by determining the performance evaluation for the target system, the operation and maintenance personnel can intuitively understand the current overall operation status of the target system. Furthermore, in the risk identification results, for the risk type whose probability of occurrence is greater than the set threshold, the solution corresponding to the risk type is determined, and the solution is sent to the target device to provide relevant prompts to the operation and maintenance personnel.

[0107] In an exemplary embodiment, a risk warning method is provided, which is applied to a computer device. The target system may be configured on a computer device that executes the risk warning method of the embodiment of the present application, or may be configured on other computer devices, which is not specifically limited in the present application. Figure 7 The overall flow chart of the method may specifically include steps S1 to S5, wherein:

[0108] S1. Collect data around services and decentralize them;

[0109] S2, collect risk parameter data and use machine learning to build a predictive model to identify risk factors;

[0110] S3. Use the log platform of cloud-native security operations to collect logs of various components, feed real-time monitoring data into the prediction model, and update risk data in real time.

[0111] S4. Based on risk assessment data, risk levels are divided into multiple levels to achieve effective management of different risk levels;

[0112] S5. When the prediction model is running at a specified time or when the business system is connected, the real-time collected data is used to comprehensively evaluate and optimize the model to improve the accuracy of the prediction model.

[0113] Specifically, in this method, three components are configured on the computer device, namely, the data collection component (collector), the prediction model building component (model), and the real-time monitoring component (monitor). Among them, the data collection component is decentralized, used to collect data related to the system periphery, and runs on each engine node; the prediction model component is used to collect indicator data related to system risks, use machine learning to build a prediction model (risk identification model), identify factors that may cause risks, and run on a separate central server; the real-time monitoring component: used to monitor the collected data in real time, feed the real-time data back to the prediction model, update the risk assessment data in real time, and achieve the purpose of customized early warning for trends and key indicators.

[0114] Furthermore, the following content explains the functions and uses of each component in more detail.

[0115] For the embodiment of the present application, the Collector component service is deployed on each node connected to the cloud SaaS service (target system); the prediction model component modle service is deployed on the central cloud server (the computer device that executes the risk warning method of the present application); the monitor service is deployed on the central cloud server, which can customize the risk level and risk notification and draw the risk trend of the system; on the data platform, all data is aggregated and an interface is provided to the model service.

[0116] In step S1, specifically, the Collector component runs on each node of the system (target system) and shares the same container with the system. Through the probe, it supports real-time reading of business logs and security logs of each node of the system, reads key log information through delimiters, parses logs and processes each field, and then uploads batch logs to the data collection platform. The process of reading node logs is as follows: Figure 8 As shown, log_file represents the log file, file_parse represents the parsing of the log file, Log_parse represents the path of the log file, writer represents the write object (generate object) of the log file, Parse_1-Parse_n represent the path point; write_1-write_n represent the sequence number of the write object; secure_data represents the secure data, system represents the target system, and log_cluster represents the log cluster.

[0117] In one embodiment, referring to Fig. 9 In step S2, the specific process of constructing the prediction model may include steps S21 to S26, wherein:

[0118] S21. Obtain risk factors, including system status and business, through analysis of business systems and historical alarms;

[0119] S22. Based on the collected risk data, feature selection is performed to select a risk factor data set;

[0120] S23, dividing the risk factors into a training set and a test set;

[0121] S24, select multiple linear regression combined with decision tree to build a prediction model;

[0122] S25. Based on the training set, the prediction model is trained and parameters are tuned to obtain a trained prediction model;

[0123] S26. Evaluate the trained prediction model based on the training set.

[0124] Specifically, a prediction model component (model) is constructed to build a prediction model, and the Model component runs on a separate server. The first step is to collect relevant risk factors; through the analysis of business systems and historical alarms, potential risk factors, including system status, business, etc., are obtained, and then feature selection is performed to select risk factor data participating in the model. Feature selection specifically calculates the Pearson correlation coefficient of each risk factor for the SaaS cloud service. The closer the coefficient is to 1, the closer the relationship between the two variables is. The risk factors are then sorted in descending order, and the top 30% are selected as the risk factor data set. In the second and third steps, based on the collected risk factor data set, it is divided into a training set and a test set; 70% of the data is selected as the training set as the basis for training and parameter tuning, and the remaining 30% of the data is used as the test set to evaluate the performance of the prediction model.

[0125] Step 4: Select multiple linear regression combined with decision tree to build a prediction model. Use the relationship between the risk factor dataset selected in the first step and the cloud service risk to build a linear regression model to describe the quantitative relationship between parameters and system risk; the decision tree, based on the threshold of risk factors or information gain, performs hierarchical division between multiple parameters to discover the rules and risk factors that trigger system risks. Step 5: Based on the training set, perform multiple rounds of training verification and parameter tuning on the prediction model to obtain the trained prediction model.

[0126] The sixth step is to use the test set to evaluate the trained prediction model. The mean square error and determination coefficient are used to measure the model's fit and accuracy. When the prediction model runs for a specified time or the business system is connected, the newly collected data is used to comprehensively evaluate and optimize the model to improve the accuracy of the prediction model.

[0127] In one embodiment, if Fig.10 As shown, step S4 may specifically include steps S41 to S44, wherein:

[0128] Step S41, dividing the risk level into multiple levels;

[0129] Step S42: Determine the risk value interval for each level based on historical experience;

[0130] Step S43: Use hierarchical analysis to weight each risk factor and obtain the result;

[0131] Step S44: Take corresponding management measures according to the risk level.

[0132] By feeding the real-time data collected by the monitoring component (monitor) back to the prediction model, the model can be updated in real time. According to the output results of the prediction model, real-time risk assessment can be carried out and risk trends can be recorded. The risk level (performance evaluation) can be divided into multiple levels. Based on historical experience, the risk value range of each risk level can be determined. The hierarchical analysis method is used to weight each risk factor to obtain the results, so as to timely grasp the changes in cloud service risks, provide managers with real-time warnings, and improve the effectiveness of risk management.

[0133] The risk warning method of the present application collects multiple indicators related to cloud services to comprehensively consider the direct combined impact of multiple indicators. Machine learning is used to build a prediction model, train and learn the collected indicators, identify risk factors, and perform weight analysis on risk factors. The collected logs are fed back to the prediction model for real-time monitoring and timely warning. It has the characteristics of quantitative and high real-time requirements, and can achieve quantitative risk warning. Compared with the existing technology, it has the following advantages:

[0134] By using machine learning to comprehensively consider multiple risk indicator factors and train the weights of the indicators for further evaluation, we can obtain the trend of risks and view the status trend of the system from a global perspective.

[0135] Versatility: By providing a universal prediction model, it supports real-time analysis of multiple risk factors;

[0136] Real-time performance: The real-time performance of processing is improved through mechanisms such as minute-level monitoring of device status and real-time data processing.

[0137] Identify risk trends of systems or services: Help security managers identify the security status of assets or systems, and make security status judgments on assets or services in advance based on the assessment results, so as to take corresponding security measures.

[0138] Improve management efficiency and reduce costs: Through real-time risk quantification assessment, management efficiency can be improved and management and maintenance costs can be reduced.

[0139] Enhance security and visibility: Use risk assessment methods to monitor risk values ​​and trends in real time from different dimensions on the monitoring screen (target device), and configure thresholds to generate real-time alarms.

[0140] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0141] Based on the same inventive concept, the embodiment of the present application also provides a risk warning device for implementing the risk warning method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more risk warning device embodiments provided below can refer to the limitations on the risk warning method above, and will not be repeated here.

[0142] In an exemplary embodiment, Fig.11 As shown, a risk warning device is provided, including an information acquisition module 1101, a model processing module 1102 and an update module 1103, wherein:

[0143] The information acquisition module 1101 is used to acquire the system information of the target system, and the system information includes the status data of each node;

[0144] The model processing module 1102 is used to call the risk identification model to process the system information and obtain the risk identification result for the target system output by the risk identification model; the risk identification result includes the probability of each risk type occurring; wherein the risk identification model is obtained by training based on the training samples, and the training samples are constructed based on the historical risk events of the target system;

[0145] The updating module 1103 is used to update the risk trend map of the target system based on the risk identification result, and send the updated risk trend map to the target device.

[0146] In one embodiment, the risk warning device further includes a training module, and the training module is specifically used for:

[0147] Obtain multiple historical risk events of the target system, analyze each historical risk event, and determine the associated nodes corresponding to each risk type;

[0148] For each risk type, based on the associated nodes corresponding to the risk type, determine the risk factor of the risk type in each historical risk event;

[0149] Construct training samples for the risk factors and risk type status of each historical risk event;

[0150] The initial model is trained based on each training sample to obtain a risk identification model.

[0151] In one embodiment, the training module is further configured to:

[0152] For each risk type, each historical risk event is used as source data, and the correlation between the risk type and each node is determined from the source data;

[0153] Based on the correlation, the associated nodes corresponding to the risk type are determined.

[0154] In one embodiment, the training module is further configured to:

[0155] Based on the correlation, the risk factors corresponding to the risk types are weighted;

[0156] The weighted risk factor is used as sample data, and the state of the risk type is used as the sample label to construct a training sample.

[0157] In one embodiment, the training module is further configured to:

[0158] Divide each training sample into a training set and a test set;

[0159] The initial model is trained based on the training set, and the trained initial model is tested based on the test set to obtain the test result;

[0160] If the test results meet the preset conditions, the trained initial model is determined to be a risk identification model.

[0161] In one embodiment, the risk warning device further includes a performance evaluation module, which is specifically used to:

[0162] Based on the risk identification results, the weight corresponding to each risk type is determined from a mapping table, which includes the corresponding relationship between the probability of each risk type occurring and the weight;

[0163] Based on the weight corresponding to each risk type, determine the performance evaluation for the target system.

[0164] Each module in the above risk warning device can be implemented in whole or in part by software, hardware or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations corresponding to each module.

[0165] In an exemplary embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as shown in FIG. Fig.12 As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and the external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be realized through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, a risk warning method is realized. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0166] Those skilled in the art will understand that Fig.12 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0167] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, any step in the above-mentioned risk warning method embodiment is implemented.

[0168] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, any step in the above-mentioned risk warning method embodiment is implemented.

[0169] In one embodiment, a computer program product is provided, including a computer program, which, when executed by a processor, implements any step in the above-mentioned risk warning method embodiment.

[0170] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0171] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0172] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0173] The above embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A risk early warning method, characterized in that: The method comprises: Acquire system information of the target system, wherein the system information includes status data of each node; Calling a risk identification model to process the system information, and obtaining a risk identification result for the target system output by the risk identification model; the risk identification result includes the probability of each risk type occurring; wherein the risk identification model is obtained by training based on training samples, and the training samples are constructed based on various historical risk events of the target system, and the historical risk events include the system information corresponding to the target system at the time of historical failure, and the corresponding status of each risk type; Based on the risk identification result, the risk trend map of the target system is updated, and the updated risk trend map is sent to the target device.

2. The method according to claim 1, characterized in that The training process of the risk identification model includes: Acquire a plurality of the historical risk events of the target system, and analyze each of the historical risk events to determine an associated node corresponding to each risk type; For each of the risk types, based on the associated nodes corresponding to the risk type, determine the risk factor of the risk type in each of the historical risk events; constructing the training sample for the risk factor of the risk type in each of the historical risk events and the state of the risk type; The initial model is trained based on each of the training samples to obtain the risk identification model.

3. The method according to claim 2, characterized in that The parsing of each of the historical risk events to obtain a correlation node corresponding to each of the risk types includes: For each of the risk types, each of the historical risk events is used as source data, and the correlation between the risk type and each of the nodes is determined from the source data; Based on the correlation, the associated node corresponding to the risk type is determined.

4. The method according to claim 3, characterized in that The step of constructing the training sample for the risk factor of the risk type in each of the historical risk events and the state of the risk type includes: Based on the correlation, weighting the risk factor corresponding to the risk type; The weighted risk factor is used as sample data, and the state of the risk type is used as a sample label to construct a training sample.

5. The method according to claim 4, characterized in that The step of training the initial model based on each of the training samples to obtain the risk identification model includes: Dividing each of the training samples to obtain a training set and a test set; Training the initial model based on the training set, and testing the trained initial model based on the test set to obtain a test result; If the test result meets the preset conditions, the trained initial model is determined to be the risk identification model.

6. The method according to any one of claims 1 to 5, characterized in that The method further comprises: Based on the risk identification result, determining a weight corresponding to each of the risk types from a mapping table, wherein the mapping table includes a correspondence between a probability of occurrence of each of the risk types and a weight; Based on the weight corresponding to each of the risk types, a performance evaluation for the target system is determined.

7. A risk warning device, characterized in that: The device comprises an information acquisition module, a model processing module and an updating module, wherein: An information acquisition module is used to acquire system information of the target system, wherein the system information includes status data of each node; A model processing module, used for invoking a risk identification model to process the system information, and obtaining a risk identification result output by the risk identification model for the target system; the risk identification result includes the probability of each risk type occurring; wherein the risk identification model is obtained by training based on training samples, and the training samples are constructed based on various historical risk events of the target system, and the historical risk events include the system information corresponding to the target system at the time of historical failure, and the corresponding status of each risk type; An updating module is used to update the risk trend map of the target system based on the risk identification result, and send the updated risk trend map to the target device.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images