Information system operation and maintenance management method and system based on bastion host and artificial intelligence

Abstract

The invention relates to the technical field of information system operation and maintenance management, in particular to an information system operation and maintenance management method and system based on a bastion host and artificial intelligence, and the method comprises the steps: obtaining a keyboard tapping interval time record, a mouse moving position record and a screen operation area stay duration record in real time; extracting an operation speed change value from the track offset metric value, performing combined calculation on the operation speed change value and a staying duration record of the screen operation area, and evaluating a ratio record related to the relevance between the operation speed change and the staying duration extension according to the time sequence change; and applying an exception identification rule to the user operation behavior record according to the risk level label, adjusting and updating a critical value adjustment standard according to the record, and adjusting the identification sensitivity through a loop optimization process to obtain an optimized critical value combination. According to the method, the dynamic association between the operation speed change and the interface stay duration can be captured in a complex scene, so that accurate behavior anomaly recognition is realized, and the management accuracy and practicability are improved.

Description

Technical Field

[0001] This invention relates to the field of information system operation and maintenance management technology, and more specifically to an information system operation and maintenance management method and system based on bastion host and artificial intelligence. Background Technology

[0002] In the operation and maintenance management of modern data center information systems, bastion hosts, as core security devices, are responsible for monitoring and managing the behavior of operators. Their importance lies in ensuring a balance between system security and operational efficiency. With the increasing demands of enterprises for data security and compliance, bastion hosts, by recording and analyzing operational behavior, have become a key tool for preventing internal threats and misoperations.

[0003] However, current bastion host systems face numerous challenges in behavior monitoring and anomaly detection. Existing methods often rely on fixed rules or simple threshold settings for anomaly detection, which is ill-suited to the complexity and diversity of operator behavior. For example, detection based on a single metric might mistakenly identify rapid keystrokes as abnormal or a brief deviation in mouse trajectory as a potential threat. This overly rigid detection logic leads to frequent false alarms, interfering with the normal work of operations and maintenance personnel and even reducing their trust in the system. Furthermore, ignoring the dynamic correlations between operator behaviors makes it difficult for the system to accurately distinguish between normal operational fluctuations and genuine security risks.

[0004] The core technical challenge lies in dynamically analyzing operator behavior patterns, particularly the interaction between changes in operation speed and screen dwell time. Changes in operation speed refer to fluctuations in keyboard keystroke intervals or mouse movement speed, while screen dwell time reflects the operator's attention span for a specific screen area. These behavioral characteristics are not isolated but interconnected. For example, when handling complex tasks, maintenance personnel may slow down their operation speed due to thinking, leading to longer keyboard keystroke intervals and increased screen dwell time. If the system relies solely on fixed thresholds, it might misinterpret this normal behavior as abnormal, triggering unnecessary alerts. For instance, when maintenance personnel slow down their keystrokes and extend their screen dwell time while debugging complex parameters on a server configuration interface, the system might issue an alert due to detected operation speed below a threshold or abnormal screen dwell time.

[0005] Therefore, how to capture the dynamic correlation between changes in operation speed and duration of interface dwell in complex scenarios, and thus achieve accurate identification of behavioral anomalies and improve management accuracy and practicality, is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0006] In view of this, the present invention provides an information system operation and maintenance management method and system based on bastion host and artificial intelligence, which can capture the dynamic correlation between changes in operation speed and interface dwell time in complex scenarios, thereby achieving accurate identification of abnormal behavior and improving management accuracy and practicality.

[0007] To achieve the above objectives, the present invention adopts the following technical solution:

[0008] In a first aspect, the present invention provides an information system operation and maintenance management method based on bastion hosts and artificial intelligence, characterized by comprising the following steps:

[0009] S1. Obtain keystroke interval records, mouse movement position records, and screen operation area dwell time records to generate standardized user operation behavior records;

[0010] S2. Perform time-series analysis on the standardized user operation behavior records, identify the response delay time in the keyboard keying interval time records, and generate preliminary identification results of abnormal behavior based on the comparison of the response delay time with a preset threshold.

[0011] S3. Combine the preliminary identification results of the abnormal behavior with the mouse movement position record to generate comprehensive operation trajectory data. Classify the trajectory according to the coordinate offset distance to generate groups of different offset levels and corresponding trajectory offset measurement values.

[0012] S4. Extract the operation speed change value from the trajectory offset metric value, and combine it with the screen operation area dwell time record to generate a ratio record of the correlation between speed change and dwell time extension.

[0013] S5. Perform threshold judgment on the ratio record, identify abnormal patterns that are continuously higher than the dynamic critical value, and generate risk level labels.

[0014] S6. Classify and statistically analyze user operation behavior records according to the risk level labels, calculate performance evaluation index values ​​based on the false alarm rate and false negative rate under each risk level, and adjust the dynamic threshold value according to the performance evaluation index value to generate an optimized dynamic threshold value combination.

[0015] S7. Select the dynamic threshold value corresponding to the risk level label from the optimized dynamic threshold value combination, apply it to the bastion host system to trigger the differentiated response strategy, and generate operation and maintenance management results.

[0016] Furthermore, S1 includes:

[0017] The keyboard keystroke interval time record is obtained, and the repeated keystroke noise is identified and removed by timestamp verification to obtain the filtered keyboard behavior data.

[0018] Align the filtered keyboard behavior data and mouse movement position records along the timeline to match corresponding operation events;

[0019] By analyzing the coordinate information of the screen operation area, the duration of the user's stay in a specific screen operation area can be calculated;

[0020] An operation sequence index table is constructed according to time order, recording the timestamp, event type, and duration of each operation event. A normalization method is used to unify the data units, generating standardized user operation behavior records.

[0021] Furthermore, S2 includes:

[0022] Construct a sliding time window, calculate the time difference between adjacent keystroke events, and generate a response delay time series;

[0023] Determine the baseline value for response delay based on the statistical distribution of historical operational data;

[0024] The response delay time series is compared with a baseline value, and records of suspicious or normal behavior are marked.

[0025] Density clustering algorithm is used to identify continuous abnormal time periods. By judging whether the time interval between adjacent suspicious markers is less than a preset interval threshold, abnormal behavior segments are merged to obtain preliminary results of abnormal behavior identification.

[0026] Furthermore, S3 includes:

[0027] Obtain the timestamp sequence from the preliminary identification results of abnormal behavior, align it with the time of mouse movement position recording, fill in the missing coordinate data, and generate comprehensive operation trajectory data that includes keyboard operation abnormal markers and mouse trajectory coordinates;

[0028] Extract the mouse coordinate sequence within a continuous time period from the comprehensive operation trajectory data, calculate the Euclidean distance between adjacent coordinate points, and determine the trajectory deviation value based on the average distance within the time period corresponding to the keyboard operation anomaly marker; the trajectory deviation value is the ratio between the average distance within the time period corresponding to the keyboard operation anomaly marker and the average movement distance during the normal operation period.

[0029] Based on the trajectory offset values, feature vectors are constructed, and the feature vectors are clustered using the K-means clustering algorithm to generate trajectory groups with different offset levels;

[0030] Calculate the mean and standard deviation of the offset distance of all trajectory segments within each trajectory group, and determine the trajectory offset metric value corresponding to each group by a linear combination of the mean and standard deviation.

[0031] Furthermore, S4 includes:

[0032] The mouse movement distance sequence within each time period is analyzed from the trajectory offset metric, and the instantaneous operation speed is obtained by calculating the ratio of the distance difference between adjacent time points to the time interval.

[0033] Perform a differential operation on the instantaneous operating speed to generate a numerical value of the operating speed change;

[0034] Extract the dwell time data for the corresponding time period from the dwell time record of the screen operation area, and construct a dataset that pairs speed change with dwell time;

[0035] Calculate the correlation coefficient of the paired dataset. If the absolute value of the correlation coefficient exceeds a preset threshold, extract the absolute value of the speed change and the increment of the dwell time relative to the baseline time within that period.

[0036] Calculate the ratio of the absolute value of the speed change to the increment of the dwell time within each time window, and generate a record of the ratio of the correlation between the change in operating speed and the extension of dwell time.

[0037] Furthermore, S5 includes:

[0038] The mean and standard deviation of the ratio are calculated based on the statistical distribution of historical normal operation data. The dynamic critical value is determined by adding the standard deviation of the mean to a preset multiple.

[0039] The ratio of the correlation between speed change and dwell time extension is monitored by a sliding window. If the number of consecutive ratio data points in the window exceeds a preset value and is higher than the dynamic threshold, the time period is marked as high risk of misoperation; otherwise, it is marked as normal change.

[0040] Based on the labeled results, a corresponding risk level label is assigned to each time period, generating a label record containing time information and risk level.

[0041] Furthermore, S6 includes:

[0042] User operation behavior records are classified and statistically analyzed based on risk level labels. The false positive rate and false negative rate under each risk level are calculated. The current performance evaluation index value is generated by calculating the weighted sum of the false positive rate and false negative rate.

[0043] Compare the current performance evaluation index value with the expected threshold. If the current performance evaluation index value is lower than the expected performance threshold, adjust the dynamic threshold value according to the difference between the false alarm rate and the false alarm rate. When the false alarm rate is greater than the false alarm rate, increase the dynamic threshold value, and vice versa, decrease the dynamic threshold value to obtain the adjusted dynamic threshold value.

[0044] Historical operation records are re-identified using the adjusted dynamic threshold, and new performance evaluation index values ​​are calculated. The dynamic threshold is iteratively adjusted using the gradient descent method until the performance evaluation index converges, generating the optimized dynamic threshold.

[0045] Based on the optimized dynamic threshold, and combined with the feature differences of different time periods and operation scenarios, a multi-dimensional threshold combination including basic threshold and scenario threshold is constructed. The combination effect is evaluated through cross-validation, and the parameter set with the highest recognition accuracy is selected as the optimized dynamic threshold combination.

[0046] Furthermore, in S6, the basic threshold value serves as a global reference standard applicable to all scenarios; the scenario threshold value is fine-tuned for different time periods such as working hours, non-working hours, system maintenance windows, as well as different scenarios such as database operations, file system operations, and network configurations.

[0047] Furthermore, S7 includes:

[0048] Based on the risk level label of the current operation, select the corresponding critical value parameter from the optimized critical value combination. The high-risk label corresponds to the lower limit critical value of the critical value combination, and the normal change label corresponds to the upper limit critical value of the critical value combination.

[0049] If the operation record belongs to the high-risk label and the feature value exceeds the lower limit threshold, the real-time alert response mechanism will be triggered to perform alarm notification and access control operations and generate a high-risk handling record.

[0050] Maintain standard monitoring for normal change label records, record operation time and type, and generate standard monitoring records;

[0051] Integrate high-risk handling records and standard monitoring records to generate operation and maintenance management results.

[0052] Secondly, the present invention provides an information system operation and maintenance management system based on a bastion host and artificial intelligence, which employs the method described above, including:

[0053] The data acquisition and preprocessing module is used to acquire records of keyboard keystroke intervals, mouse movement positions, and screen operation area dwell times, and generate standardized user operation behavior records.

[0054] The preliminary anomaly identification module is used to perform time-series analysis on the standardized user operation behavior records, identify the response delay time in the keyboard keystroke interval time records, and generate a preliminary anomaly identification result based on the comparison of the response delay time with a preset threshold.

[0055] The trajectory offset analysis module is used to combine the preliminary identification results of the behavior anomaly with the mouse movement position record to generate comprehensive operation trajectory data, classify the trajectory according to the coordinate offset distance, and generate groups of different offset levels and corresponding trajectory offset measurement values.

[0056] The correlation analysis module is used to extract the operation speed change value from the trajectory offset metric value and combine it with the screen operation area dwell time record to generate a ratio record of the correlation between speed change and dwell time extension.

[0057] The risk assessment module is used to perform threshold judgment on the ratio records, identify abnormal patterns that are continuously higher than the dynamic critical value, and generate risk level labels.

[0058] The threshold optimization module is used to classify and statistically analyze user operation behavior records according to the risk level labels, calculate performance evaluation index values ​​based on the false alarm rate and false negative rate under each risk level, and adjust the dynamic threshold value according to the performance evaluation index value to generate an optimized dynamic threshold value combination.

[0059] The differentiated response strategy execution module is used to select the dynamic threshold value corresponding to the risk level label from the optimized dynamic threshold value combination, apply it to the bastion host system to trigger the differentiated response strategy, and generate operation and maintenance management results.

[0060] As can be seen from the above technical solution, compared with the prior art, the present invention has the following beneficial effects:

[0061] This invention identifies abnormal behavior patterns by analyzing keyboard response latency over time, combining the correlation ratio between mouse trajectory deviation and operation speed and dwell time, and determines risk levels based on dynamic thresholds. It optimizes critical value combinations, triggers differentiated response strategies, provides real-time alerts for high-risk behaviors, and maintains standard monitoring for normal behaviors. Through multi-dimensional behavioral data fusion and dynamic threshold optimization, this invention accurately identifies user misoperation risks and dynamically adjusts monitoring strategies in business scenarios, achieving precise identification and adaptive management of misoperation risks, and improving the security and operational efficiency of bastion host systems. Attached Figure Description

[0062] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0063] Figure 1 A flowchart illustrating the information system operation and maintenance management method based on bastion host and artificial intelligence provided by this invention;

[0064] Figure 2 The structural block diagram of the information system operation and maintenance management system based on bastion host and artificial intelligence provided by the present invention. Detailed Implementation

[0065] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0066] like Figure 1 As shown in the figure, this invention discloses an information system operation and maintenance management method based on bastion host and artificial intelligence, including the following steps:

[0067] S1. Obtain keystroke interval records, mouse movement position records, and screen operation area dwell time records to generate standardized user operation behavior records;

[0068] S2. Perform time-series analysis on standardized user operation behavior records, identify response delay time in the keyboard keystroke interval time record, and generate preliminary identification results of abnormal behavior based on the comparison of response delay time with preset threshold.

[0069] S3. Combine the preliminary identification results of abnormal behavior with the mouse movement position record to generate comprehensive operation trajectory data. Classify the trajectory according to the coordinate offset distance and generate groups of different offset levels and corresponding trajectory offset measurement values.

[0070] S4. Extract the operation speed change value from the trajectory offset metric and combine it with the screen operation area dwell time record to generate a ratio record of the correlation between speed change and dwell time extension.

[0071] S5. Compare the recorded values ​​to determine the threshold, identify abnormal patterns that are continuously higher than the dynamic threshold, and generate risk level labels.

[0072] S6. Classify and statistically analyze user operation behavior records according to risk level labels, calculate performance evaluation index values ​​based on false alarm rate and false negative rate under each risk level; adjust dynamic threshold values ​​according to performance evaluation index values ​​to generate optimized dynamic threshold value combinations.

[0073] S7. Select the dynamic threshold value corresponding to the risk level label from the optimized dynamic threshold value combination, apply it to the bastion host system to trigger differentiated response strategies, and generate operation and maintenance management results.

[0074] The following provides further explanation of each of the above steps.

[0075] S1. Obtain keystroke interval records, mouse movement position records, and screen operation area dwell time records to generate standardized user operation behavior records, specifically including:

[0076] The system obtains keyboard keystroke interval records from the data acquisition interface of the bastion host system. Duplicate records and out-of-order data are identified by timestamp verification. If the timestamp difference is less than the preset duplication threshold, it is determined to be duplicate keystroke noise and is removed, thus obtaining filtered keyboard behavior data.

[0077] The filtered keyboard behavior data and mouse movement position records are aligned on a timeline, and the corresponding operation events are matched based on the common timestamp.

[0078] By recording the duration of time spent in the screen's operating area, an operation sequence index table is constructed in chronological order. The minimum-maximum normalization method is used to unify the dimensional range of data from different sources, resulting in standardized user operation behavior records.

[0079] For example, in one implementation, the bastion host system acquires user operation behavior data in real time through a data acquisition interface deployed on the server side. The data acquisition interface listens to input events at the system's underlying level, captures timestamp information generated by keyboard keystrokes, and records the time interval between each keystroke. When the timestamp difference between two consecutive keystrokes is less than a preset repetition threshold, the latter keystroke is determined to be noise data and removed from the recording sequence. To align the timeline of mouse movement position records with keyboard behavior data, a timestamp matching mechanism is used to associate keyboard and mouse events occurring within the same time window. By parsing the coordinate information of the screen operation area, the duration of the user's stay in a specific interface area is calculated, and an operation sequence index table is constructed according to chronological order. The index table records the timestamp, event type, and duration of each operation event.

[0080] Subsequently, the min-max normalization method was used to standardize the data from different sources, mapping data of different dimensions such as keyboard keystroke interval, mouse movement distance, and interface dwell time to a unified numerical range, thereby obtaining standardized user operation behavior records.

[0081] S2. Perform time-series analysis on standardized user operation behavior records, identify response delay times in the keystroke interval records, and generate preliminary abnormal behavior identification results based on the comparison of response delay times with preset thresholds, specifically including:

[0082] A sliding time window is constructed based on the time sequence of standardized user operation behavior records. The response delay time series is obtained by calculating the time difference between adjacent keystroke events. The response delay baseline value is determined based on the statistical distribution of historical operation data.

[0083] Each response delay time in the response delay time series is compared with the response delay baseline value. If the response delay time exceeds the product of the baseline value and a preset multiple, it is marked as a suspicious behavior record in the corresponding time period; otherwise, it is marked as a normal behavior record.

[0084] Based on the temporal distribution of suspicious and normal behavior records, density clustering algorithm is used to identify continuous abnormal time periods. Abnormal behavior segments are formed by merging adjacent suspicious markers by judging whether the time interval between them is less than a preset interval threshold, thus obtaining preliminary results of abnormal behavior identification.

[0085] For example, in one implementation, when the bastion host system performs time-series analysis on standardized user operation behavior records, it employs a sliding time window mechanism to dynamically monitor changes in the operation behavior. The sliding time window moves along the time axis in fixed time units according to a preset sliding step size, and each window contains multiple keystroke events. By calculating the timestamp difference between adjacent keystroke events within the window, a series of response latency data is obtained.

[0086] Specifically, the baseline value for response latency is determined based on statistical analysis of historical operational data. Operational records from maintenance personnel under normal working conditions are collected, and the mean and standard deviation of response latency are calculated. The mean plus twice the standard deviation is used as the initial baseline value. This statistical method can accommodate differences in the operational habits of different maintenance personnel, avoiding misjudgments due to individual differences. A dynamic multiple threshold is set during the comparison of response latency with the baseline value. When a response latency exceeds the product of the baseline value and a preset multiple, the system marks that time point as a suspicious behavior record.

[0087] For example, when maintenance personnel pause to think while handling complex configurations, resulting in a keystroke interval that is more than three times the baseline value, this period will be marked as a potential anomaly, but an alarm will not be triggered immediately. Instead, it will proceed to the subsequent cluster analysis stage.

[0088] Preferably, the DBSCAN density clustering algorithm is used to perform temporal clustering analysis on the marked suspicious behavior records. The algorithm identifies densely occurring anomalous regions based on the distribution density of suspicious markers along the time axis. When the time interval between two adjacent suspicious markers is less than a preset interval threshold, they are merged into a continuous segment of anomalous behavior.

[0089] In one embodiment, the severity of operational anomalies is further differentiated by analyzing the duration and frequency of abnormal behavior segments. Brief abnormal segments may simply be normal operational fluctuations by maintenance personnel, while longer-lasting and more frequent abnormal segments indicate potential security risks. Based on this, a preliminary classification of behavioral anomalies is output.

[0090] S3. Combine the preliminary identification results of abnormal behavior with the mouse movement position record to generate comprehensive operation trajectory data. Classify the trajectory according to the coordinate offset distance to generate groups of different offset levels and corresponding trajectory offset metrics, specifically including:

[0091] The timestamp sequence from the preliminary identification results of abnormal behavior is obtained, and time-aligned with the mouse movement position record. The coordinate data of the missing time points is filled in by interpolation method, and comprehensive operation trajectory data including keyboard operation abnormal markers and mouse trajectory coordinates is constructed.

[0092] For comprehensive operation trajectory data, extract the mouse coordinate sequence within a continuous time period, calculate the Euclidean distance between adjacent coordinate points, and determine the trajectory deviation value based on the average movement distance within the corresponding time period of the keyboard operation anomaly marker.

[0093] Feature vectors are constructed based on the trajectory offset values. K-means clustering algorithm is used to cluster the feature vectors. The number of cluster centers is set to the preset number of offset levels to obtain trajectory groups with different offset levels.

[0094] For trajectory groups with different offset levels, the mean and standard deviation of the offset distance of all trajectory segments in each group are calculated, and the trajectory offset metric value corresponding to each group is determined by a linear combination of the mean and standard deviation.

[0095] For example, in one implementation, after the bastion host system obtains the preliminary identification results of behavioral anomalies, it needs to perform precise time alignment with the mouse movement position records. The time alignment process adopts a timestamp-based matching mechanism. First, the timestamp sequence corresponding to each anomaly marker in the preliminary identification results is extracted. Then, coordinate data with the same timestamp is searched in the mouse movement position records. When mouse coordinate records are missing at certain times, a linear interpolation method is used to fill in the missing data. By calculating the position difference and time difference between two known coordinate points before and after the missing time, the coordinate value of the missing time is estimated according to the time ratio.

[0096] Specifically, the construction of comprehensive operation trajectory data involves deep fusion of multi-source data. Anomalies in keyboard operations are used as label attributes for the trajectory data, and each mouse coordinate point carries the keyboard operation status information at the corresponding moment. When a time period is marked as an abnormal keyboard operation, all mouse trajectory points within that time period inherit this anomaly label, forming a trajectory sequence with behavioral feature labels. This fusion method allows the system to simultaneously consider the behavioral characteristics of both keyboard and mouse input devices, achieving a more comprehensive analysis of operational behavior.

[0097] It should be noted that when extracting the mouse coordinate sequence over a continuous time period, the trajectory is segmented based on abnormal keyboard operation markers. Each consecutive abnormal time period is treated as an independent trajectory segment, and the movement features within each segment are calculated separately.

[0098] Preferably, the Euclidean distance is calculated using the standard formula in a two-dimensional coordinate system. For two adjacent coordinate points P1(x1,y1) and P2(x2,y2), the Euclidean distance is the square root of the sum of the squares of the differences between their x and y coordinates. Distances are calculated for all adjacent point pairs within each trajectory segment, resulting in a distance sequence. The average movement distance of the trajectory segment is obtained by calculating the average of this sequence. When the time period corresponding to a trajectory segment is marked as an abnormal keyboard operation, the average movement distance of that segment is compared with the average movement distance during normal operation periods; the ratio of the two is the deviation value of that trajectory segment. This relative measurement method can eliminate individual differences in the operating habits of different maintenance personnel and improve the accuracy of anomaly detection.

[0099] In one possible implementation, feature vector construction is a key step in achieving effective clustering. The offset value of each trajectory segment is used as the primary feature, while auxiliary features such as the duration of the trajectory segment, the rate of change of movement speed, and the frequency of direction changes are introduced to construct a multi-dimensional feature vector.

[0100] For example, a typical feature vector contains five dimensions: offset value, duration, average speed, speed standard deviation, and number of direction changes. These features characterize the degree of anomaly in mouse operations from different perspectives, providing a rich information foundation for subsequent cluster analysis.

[0101] For example, the application process of the K-means clustering algorithm includes three stages: initialization, iterative optimization, and convergence determination. First, the number of cluster centers is determined based on a preset number of offset levels, typically set to 3 to 5 levels, corresponding to different degrees of offset such as slight, moderate, and severe. In the initialization stage, k vectors are randomly selected from the feature vector set as initial cluster centers. During the iterative optimization process, each feature vector is assigned to the category of the nearest cluster center, and then the mean of all vectors within each category is recalculated as the new cluster center. When the change in the position of the cluster centers is less than a preset threshold or the maximum number of iterations is reached, the algorithm converges, and the final trajectory grouping results are output.

[0102] Understandably, trajectory groups with different offset levels exhibit distinct behavioral characteristics. Slightly offset trajectories typically show relatively smooth mouse movement paths with minimal speed variations, potentially corresponding to normal operational fluctuations by maintenance personnel. Moderately offset trajectories display some irregularity, such as frequent directional changes or sudden speed changes, possibly indicating operator inattention or fatigue. Severely offset trajectories exhibit obvious abnormal characteristics, such as sudden rapid movement after a long period of stillness, or trajectories completely deviating from the normal operating area; these characteristics may suggest potential security risks.

[0103] Furthermore, the trajectory offset metric is calculated using a linear combination of statistical characteristics. The mean and standard deviation of the offset distance are calculated for all trajectory segments within each group. These two statistics reflect the average offset level and the dispersion of the offset within that group, respectively. The weighting coefficients of the linear combination are adjusted according to the actual application scenario; typically, the weight of the mean is set to 0.7, and the weight of the standard deviation is set to 0.3. The trajectory offset metric equals the mean multiplied by its weight plus the standard deviation multiplied by its weight; this value serves as the quantitative representation of the offset level. Based on the trajectory offset metrics of different offset level groups, a multi-level abnormal behavior identification mechanism is established. When an operations and maintenance personnel's operation trajectory is classified into a high-offset-level group, and the corresponding trajectory offset metric exceeds a preset risk threshold, a real-time alarm mechanism is triggered, reminding security management personnel to conduct manual review, thereby enabling timely detection and handling of potential security threats.

[0104] S4. Extract the operation speed change value from the trajectory offset metric and combine it with the screen operation area dwell time record to generate a ratio record of the correlation between speed change and dwell time extension, specifically including:

[0105] The mouse movement distance sequence for each time period is parsed from the trajectory offset metric. The instantaneous operation speed is obtained by calculating the ratio of the distance difference between adjacent time points to the time interval. The instantaneous operation speed is then subjected to differential operation to obtain the operation speed change value with timestamp.

[0106] Based on the timestamped operation speed change values, extract the dwell time data for the corresponding time period from the dwell time record of the screen operation area, and align the two time series using the sliding window method to construct a paired dataset of speed change and dwell time.

[0107] For the paired dataset, the Pearson correlation coefficient is used to calculate the linear correlation coefficient between speed change and dwell time. If the absolute value of the correlation coefficient exceeds the preset threshold, the absolute value of speed change and the increment of dwell time relative to the baseline time are extracted within that period.

[0108] Based on the absolute value of the speed change and the increment of the dwell time, the ratio of the two within each time window is calculated. The ratio of the ratio is then smoothed using a moving average method to obtain a record of the correlation between the change in operating speed and the extension of dwell time.

[0109] For example, in one implementation, the process by which the bastion host system extracts the change in operating speed from the trajectory offset metric involves multi-layer data parsing. The trajectory offset metric essentially contains information about the distance the mouse moves. Through reverse engineering, these metrics are reconstructed into the original sequence of movement distances. Specifically, the trajectory offset metric for each time period is first read, and then, based on the weighting coefficients used in the aforementioned calculation, an inverse operation is performed to separate the average offset distance and the offset variance. The average movement speed for that time period is obtained by dividing the average offset distance by the corresponding time interval.

[0110] Specifically, calculating instantaneous operating speed requires finer time granularity. Each time interval is further subdivided into smaller time slices. For adjacent coordinate points within each time slice, the Euclidean distance is calculated and divided by the time interval to obtain the instantaneous speed value. These instantaneous speed values ​​form a time series. A first-order difference operation is performed on this series, calculating the difference between speed values ​​at adjacent moments to obtain the rate of change of speed. Each speed change value carries a corresponding timestamp, forming a time-stamped sequence of operating speed changes.

[0111] It should be noted that extracting the screen operation area dwell time record involves precise monitoring of user interface operation behavior. By monitoring the time the mouse dwells in a specific screen area, the dwell time of the user in different functional modules or operation interfaces is recorded. This dwell time data is stored in chronological order, and each record includes information such as start time, end time, and dwell area identifier.

[0112] Preferably, a sliding window method is used to achieve precise matching for time series alignment. A fixed-size time window is set and slides synchronously across the velocity change numerical series and the dwell time series. For each window position, the velocity change data and the corresponding dwell time data within the window are extracted to form paired data points. When the sampling frequencies of the two series are inconsistent, a linear interpolation method is used to upsample the low-frequency series or downsample the high-frequency series to ensure alignment of the two series in the time dimension. Each data point in the paired dataset contains three elements: timestamp, velocity change value, and dwell time value; the Pearson correlation coefficient is calculated to quantify the degree of linear correlation between velocity change and dwell time.

[0113] The mean and standard deviation of the speed change and dwell time sequences in the paired dataset are calculated, and then the covariance of the two sequences is calculated. The Pearson correlation coefficient is equal to the covariance divided by the product of the standard deviations of the two sequences, and its value ranges from -1 to 1. When the correlation coefficient is close to 1, it indicates a strong positive correlation between slowing speed and increasing dwell time; when the correlation coefficient is close to -1, it indicates a strong negative correlation; when the correlation coefficient is close to 0, it indicates no obvious linear relationship between the two. The system sets the correlation coefficient threshold to 0.6; when the absolute value exceeds this threshold, a significant association is considered to exist.

[0114] For example, for time periods with significant correlations, the absolute value of speed changes and the increment of dwell time are further extracted. The increment of dwell time is calculated based on a predetermined baseline duration, which is obtained by statistically analyzing the average dwell time under normal operating conditions. When the actual dwell time exceeds the baseline duration, the difference between the two is the increment of dwell time.

[0115] For example, if an operations and maintenance personnel spends 30 seconds on the server configuration interface, and the baseline time is 15 seconds, the increment for the time spent is 15 seconds. This relative measurement method can eliminate the influence of different operational task complexities and more accurately reflect the degree of abnormality in operational behavior.

[0116] Furthermore, the ratio calculation process reflects the dynamic relationship between speed change and dwell time. Within each time window, the absolute value of the speed change is divided by the increment of dwell time to obtain a ratio. This ratio reflects the magnitude of speed change corresponding to a unit increment of dwell time. A smaller ratio means a significant increase in dwell time while the speed change is relatively small, possibly indicating that the operator is thinking carefully or checking meticulously; a larger ratio may indicate that the operator's speed changes significantly but the dwell time does not change much, possibly indicating a rapid browsing or searching state.

[0117] Understandably, the moving average method effectively smooths out noise and abrupt changes in the ratio sequence. Using a simple moving average algorithm with an average window size of 5 data points, the arithmetic mean of the two data points before and after each position is calculated. This smoothing process eliminates the impact of short-term fluctuations, making the final ratio record more reflective of the overall trend of operational behavior. The smoothed ratio record serves as a quantitative indicator of the correlation between changes in operational speed and the extension of dwell time.

[0118] S5. Compare the recorded values ​​to determine the threshold, identify abnormal patterns that are continuously higher than the dynamic critical value, and generate risk level labels, specifically including:

[0119] The system records the ratio of changes in operating speed to the extension of dwell time. Based on the statistical distribution of historical normal operating data, the mean and standard deviation of the ratio are calculated. The dynamic critical value is determined by adding a preset multiple to the mean and the standard deviation.

[0120] A sliding window is used for continuous monitoring of ratio records. If the number of consecutive ratio data points in the window exceeds the preset threshold and is higher than the dynamic critical value, the time period is marked as high risk of misoperation; otherwise, it is marked as normal change.

[0121] Based on the marking results of high risk of misoperation and normal changes, a corresponding risk level label is assigned to each time period, resulting in a label record containing time information and risk level.

[0122] For example, in one implementation, after the bastion host system obtains the ratio records of the correlation between changes in operating speed and the extension of dwell time, it needs to establish dynamic thresholds based on historical data. The ratio records under normal operating conditions within the most recent month are extracted from the database; this historical data reflects the routine operating patterns of maintenance personnel. By calculating the arithmetic mean and standard deviation of these ratios, the statistical characteristics of normal operation can be characterized.

[0123] Specifically, the determination of the dynamic threshold adopts the anomaly detection principle in statistics. The standard deviation of the mean plus a preset multiple is used as the threshold value. The preset multiple is usually set between 2.5 and 3.5 and adjusted according to the security requirements of the actual application scenario. This dynamic adjustment mechanism allows the threshold value to adapt to changes in operation and maintenance modes at different times, avoiding the misjudgment problems that may be caused by a fixed threshold.

[0124] It's important to note that continuous monitoring via a sliding window is crucial for identifying anomalous patterns. A fixed-size time window, typically 5 to 10 data points wide, is set and slid across the ratio recording sequence point by point. At each window position, it's checked whether all ratio data points within the window are above a dynamic threshold. When the number of consecutive data points exceeds a preset threshold, an anomalous operating pattern is considered to exist during that time period. The selection of the preset threshold needs to balance detection sensitivity and false alarm rate; too small a threshold may lead to frequent false alarms, while too large a threshold may miss genuine anomalies.

[0125] Preferably, the risk level labels are assigned according to a binary classification principle. For periods that meet the continuous abnormal conditions, they are directly labeled "High Risk of Misoperation," indicating that the operational behavior of maintenance personnel during this period is significantly abnormal and requires close monitoring and review. For periods that do not meet the abnormal conditions, they are labeled "Normal Change," indicating that the operational behavior is within an acceptable fluctuation range.

[0126] In one embodiment, risk level labels are stored in association with time information to form a complete label record. Each record contains a timestamp, risk level, and related ratio data. This structured storage method facilitates subsequent risk analysis and audit traceability.

[0127] S6. Classify and statistically analyze user operation behavior records according to risk level labels, and calculate performance evaluation index values ​​based on the false positive rate and false negative rate under each risk level; adjust the dynamic threshold value according to the performance evaluation index value to generate an optimized dynamic threshold value combination, specifically including:

[0128] User behavior records are categorized and statistically analyzed based on risk level labels. The false positive rate and false negative rate are calculated for each risk level. The performance evaluation index is constructed by weighting the false positive rate and false negative rate to obtain the current identification performance value.

[0129] Compare the current performance evaluation index value with the preset expected performance threshold. If the current performance evaluation index value is lower than the expected performance threshold, adjust the threshold value according to the difference between the false alarm rate and the false negative rate. When the false alarm rate is greater than the false negative rate, increase the threshold value; otherwise, decrease the threshold value to obtain the adjusted threshold value.

[0130] The historical operation records are re-identified and verified using the adjusted critical value, and new performance evaluation index values ​​are calculated. The critical value parameters are iteratively adjusted using the gradient descent method until the performance index converges, and the converged optimized critical value is obtained.

[0131] Based on the converged optimization threshold, and combined with the feature differences of different time periods and operation scenarios, a multi-dimensional threshold combination containing basic threshold and scenario threshold is constructed. The combination effect is evaluated through cross-validation, and the parameter set with the highest recognition accuracy is selected as the optimized threshold combination.

[0132] For example, in one implementation, the bastion host system systematically categorizes and statistically processes user operation records based on risk level labels. First, all operation records with risk level labels are divided into two categories: "High Risk of Misoperation" and "Normal Changes." Then, the sample size for each category is counted. The false positive rate is calculated as the number of normal operations incorrectly labeled as high-risk divided by the total number of all normal operations. The false negative rate is calculated as the number of high-risk operations incorrectly labeled as normal divided by the total number of all high-risk operations. These two metrics reflect the accuracy of the identification rules from different dimensions. A high false positive rate leads to frequent false alarms, affecting operational efficiency; a high false negative rate may miss real security threats.

[0133] Specifically, the performance evaluation metrics are constructed using a weighted summation method that comprehensively considers both false positive and false negative rates. Weighting coefficients are set according to the security requirements of the actual application scenario. For core server operations with strict security requirements, the weight for false negative rate is set to 0.7, and the weight for false positive rate is set to 0.3, reflecting the security principle of erring on the side of over-reporting rather than under-reporting. The performance evaluation metric is calculated by multiplying the false positive rate by its weight and then adding the false negative rate by its weight, resulting in a comprehensive value reflecting the identification effect. The expected performance threshold is pre-set based on the tolerance of operation and maintenance management, typically between 0.2 and 0.3, representing the maximum acceptable overall error rate.

[0134] It's important to note that the decision-making logic for adjusting the threshold is based on the relative relationship between the false positive rate and the false negative rate. When the recognition performance value is lower than the expected performance threshold, it's determined whether the false positive problem or the false negative problem is more serious. The difference between the false positive rate and the false negative rate is calculated. If the difference is positive, it means the false positive rate is greater than the false negative rate. In this case, the threshold setting is too sensitive, and the threshold needs to be increased to reduce false positives. If the difference is negative, it means the false negative rate is greater than the false positive rate, and the threshold setting is too lenient. The threshold needs to be decreased to reduce false negatives. The adjustment range is dynamically determined based on the absolute value of the difference; the larger the difference, the larger the adjustment range.

[0135] Preferably, the gradient descent method allows the critical value to be iteratively optimized to an ideal state. The performance evaluation metric is used as the objective function, and the critical value is used as the parameter to be optimized. In each iteration, the gradient of the objective function with respect to the critical value is calculated, i.e., the rate of change of the performance metric with respect to the critical value. Based on the direction and magnitude of the gradient, the critical value is adjusted according to a preset learning rate. The learning rate is initially set to 0.01 and gradually decreases with the number of iterations to avoid oscillations near the optimal value. When the change in the performance metric is less than a preset convergence threshold after several consecutive iterations, the optimization process is considered converged, and the converged critical value is obtained. This optimization process typically requires 20 to 50 iterations, the specific number depending on the distance between the initial critical value and the optimal value.

[0136] In one possible implementation, the construction of multi-dimensional threshold combinations considers the characteristic differences of different time periods and operational scenarios. It identifies different time periods such as working hours, non-working hours, and system maintenance windows, as well as different scenarios such as database operations, file system operations, and network configurations. Each dimension has its specific operational patterns and risk characteristics. The basic threshold serves as a global reference standard applicable to all scenarios; scenario-specific thresholds are then fine-tuned for specific scenarios.

[0137] For example, operations during maintenance windows are usually intensive and complex, so the corresponding scenario thresholds can be appropriately relaxed; however, for operation scenarios involving modifications to core configuration files, the scenario thresholds need to be more stringent.

[0138] For example, the implementation of cross-validation ensures the generalization ability of the critical value combinations. Historical operation records are divided into multiple datasets in chronological order, and a k-fold cross-validation method is used, where k is typically set to 5 or 10. In each round of validation, critical value combinations are trained using k-1 datasets, and then tested on the remaining dataset. By rotating the test set, the performance of the critical value combinations under different data distributions is evaluated. Furthermore, the calculation of recognition accuracy comprehensively considers four cases: true positives, true negatives, false positives, and false negatives. Accuracy equals the number of correctly identified samples divided by the total number of samples, where correct identification includes correctly marking high-risk true positives as high-risk and correctly marking normal operations as normal true negatives. For each candidate critical value combination, its average accuracy in cross-validation is calculated, and the combination with the highest average accuracy is selected as the final optimized result.

[0139] Understandably, the optimized combination of threshold values ​​forms a multi-layered anomaly detection system. Basic threshold values ​​provide a stable baseline, ensuring fundamental anomaly detection capabilities across various scenarios; scenario-specific threshold values ​​offer flexible adjustment space, adapting to the specific needs of particular scenarios. This combination strategy guarantees both comprehensiveness and targetedness in identification, achieving an effective balance between false positives and false negatives.

[0140] In one embodiment, the optimized combination of threshold values ​​is applied to the real-time monitoring process, automatically selecting the corresponding threshold value for anomaly detection based on the current time and operational scenario. This adaptive identification mechanism enables the bastion host system to maintain stable identification performance under different operational scenarios, providing reliable assurance for the secure operation and maintenance of the data center.

[0141] S7. Select the dynamic threshold value corresponding to the risk level label from the optimized dynamic threshold value combination, apply it to the bastion host system to trigger differentiated response strategies, and generate operation and maintenance management results, specifically including:

[0142] From the optimized critical value combination, the corresponding critical value parameter is selected according to the risk level label of the current operation. The high-risk label corresponds to the lower limit critical value in the combination, and the normal change label corresponds to the upper limit critical value in the combination, so as to obtain the judgment threshold for different risk levels.

[0143] Regarding the judgment threshold, if the operation record belongs to the high-risk label and its feature value exceeds the lower limit threshold, the real-time alert response mechanism is triggered to perform alarm notification and access control operations, and obtain the high-risk handling record.

[0144] Based on the high-risk handling records, detailed log entries are made. At the same time, standard monitoring is maintained for operations with normal changes in tags, recording only the operation time and type. By integrating the high-risk handling records and standard monitoring records, a complete operation and maintenance management result is formed.

[0145] For example, in one implementation, the bastion host system selects the corresponding threshold from an optimized combination of thresholds based on a precise match of risk levels. A threshold configuration table is maintained, storing threshold parameters corresponding to different risk levels. When an operation record with a risk level label is received, the corresponding threshold is retrieved by querying the configuration table. The lower threshold value corresponding to the high-risk label is set more strictly to capture minor abnormal behavior; the upper threshold value corresponding to the normal change label is relatively lenient, allowing for normal operational fluctuations.

[0146] Specifically, the core of the differentiated response strategy lies in taking different intensities of handling measures based on the risk level. For operations marked as high-risk, a real-time alert response mechanism is activated, which includes multiple levels of response actions. First, an immediate alert notification is sent to the security administrator, including the operator's identity, operation time, specific operation content, and a description of abnormal characteristics. Simultaneously, the operator's sensitive permissions are temporarily frozen to prevent potential further damage. All relevant operation details are fully recorded in the security audit log, including keyboard input sequences, mouse trajectory coordinates, and screen operation screenshots.

[0147] It should be noted that for operations involving normal label changes, standard monitoring is maintained. This monitoring mode consumes fewer system resources. Standard monitoring only records basic information, including the operation timestamp, operator identifier, and operation type code, without recording detailed behavioral trajectories. This tiered approach ensures both rigorous monitoring of high-risk behaviors and avoids excessive intervention in normal operations.

[0148] Preferably, the format of the high-risk response records is designed with subsequent security analysis needs in mind. Each response record includes the event number, risk level, trigger time, response measures, response result, and associated original operational data. These structured records facilitate post-event analysis and review by security management personnel.

[0149] In one embodiment, the operation and maintenance management results are generated by integrating different types of monitoring records. High-risk handling records and standard monitoring records are merged in chronological order to form a unified operation and maintenance management log. Each log record is labeled with its source type, enabling managers to quickly identify which are high-risk events requiring special attention and which are routine operation records. The final operation and maintenance management results are presented in report form, including risk event statistics, operation frequency analysis, and abnormal behavior trend charts, providing data support for operation and maintenance management decisions.

[0150] like Figure 2 As shown, the present invention also provides an information system operation and maintenance management system based on a bastion host and artificial intelligence, which adopts the above method and includes:

[0151] The data acquisition and preprocessing module is used to acquire records of keyboard keystroke intervals, mouse movement positions, and screen operation area dwell times, and generate standardized user operation behavior records.

[0152] The preliminary anomaly identification module is used to perform time-series analysis on standardized user operation behavior records, identify response delay time in the keystroke interval time record, and generate preliminary anomaly identification results based on the comparison of response delay time with preset threshold.

[0153] The trajectory offset analysis module is used to combine the preliminary identification results of abnormal behavior with the mouse movement position record to generate comprehensive operation trajectory data. The trajectory is classified according to the coordinate offset distance, and different offset levels are generated and corresponding trajectory offset measurement values ​​are generated.

[0154] The correlation analysis module is used to extract the operation speed change value from the trajectory offset metric value and combine it with the screen operation area dwell time record to generate a record of the ratio of the correlation between speed change and dwell time extension.

[0155] The risk assessment module is used to compare value records to determine thresholds, identify abnormal patterns that are continuously higher than the dynamic critical value, and generate risk level labels.

[0156] The threshold optimization module is used to classify and statistically analyze user operation behavior records according to risk level labels, calculate performance evaluation index values ​​based on false positive rate and false negative rate under each risk level, and adjust dynamic threshold values ​​according to performance evaluation index values ​​to generate optimized dynamic threshold value combinations.

[0157] The differentiated response strategy execution module is used to select the dynamic threshold value corresponding to the risk level label from the optimized dynamic threshold value combination, apply it to the bastion host system to trigger the differentiated response strategy, and generate operation and maintenance management results.

[0158] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to the method section.

[0159] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for information system operation and maintenance management based on bastion hosts and artificial intelligence, characterized in that, Includes the following steps: S1. Obtain keystroke interval records, mouse movement position records, and screen operation area dwell time records to generate standardized user operation behavior records; S2. Perform time-series analysis on the standardized user operation behavior records, identify the response delay time in the keyboard keying interval time records, and generate preliminary identification results of abnormal behavior based on the comparison of the response delay time with a preset threshold. S3. Combine the preliminary identification results of the abnormal behavior with the mouse movement position record to generate comprehensive operation trajectory data. Classify the trajectory according to the coordinate offset distance to generate groups of different offset levels and corresponding trajectory offset measurement values. S4. Extract the operation speed change value from the trajectory offset metric value, and combine it with the screen operation area dwell time record to generate a ratio record of the correlation between speed change and dwell time extension. S5. Perform threshold judgment on the ratio record, identify abnormal patterns that are continuously higher than the dynamic critical value, and generate risk level labels. S6. Classify and statistically analyze user operation behavior records according to the risk level labels, and calculate performance evaluation index values ​​based on the false alarm rate and false negative rate under each risk level. Adjust the dynamic critical value based on the performance evaluation index value to generate an optimized combination of dynamic critical values; S7. Select the dynamic threshold value corresponding to the risk level label from the optimized dynamic threshold value combination, apply it to the bastion host system to trigger the differentiated response strategy, and generate operation and maintenance management results.

2. The information system operation and maintenance management method based on bastion host and artificial intelligence according to claim 1, characterized in that, S1 includes: The keyboard keystroke interval time record is obtained, and the repeated keystroke noise is identified and removed by timestamp verification to obtain the filtered keyboard behavior data. Align the filtered keyboard behavior data and mouse movement position records along the timeline to match corresponding operation events; By analyzing the coordinate information of the screen operation area, the duration of the user's stay in a specific screen operation area can be calculated; An operation sequence index table is constructed according to time order, recording the timestamp, event type, and duration of each operation event. A normalization method is used to unify the data units, generating standardized user operation behavior records.

3. The information system operation and maintenance management method based on bastion host and artificial intelligence according to claim 1, characterized in that, S2 include: Construct a sliding time window, calculate the time difference between adjacent keystroke events, and generate a response delay time series; Determine the baseline value for response delay based on the statistical distribution of historical operational data; The response delay time series is compared with a baseline value, and records of suspicious or normal behavior are marked. Density clustering algorithm is used to identify continuous abnormal time periods. By judging whether the time interval between adjacent suspicious markers is less than a preset interval threshold, abnormal behavior segments are merged to obtain preliminary results of abnormal behavior identification.

4. The information system operation and maintenance management method based on bastion host and artificial intelligence according to claim 1, characterized in that, S3 includes: Obtain the timestamp sequence from the preliminary identification results of abnormal behavior, align it with the time of mouse movement position recording, fill in the missing coordinate data, and generate comprehensive operation trajectory data that includes keyboard operation abnormal markers and mouse trajectory coordinates; Extract the mouse coordinate sequence within a continuous time period from the comprehensive operation trajectory data, calculate the Euclidean distance between adjacent coordinate points, and determine the trajectory deviation value based on the average distance within the time period corresponding to the keyboard operation anomaly marker; the trajectory deviation value is the ratio between the average distance within the time period corresponding to the keyboard operation anomaly marker and the average movement distance during the normal operation period. Based on the trajectory offset values, feature vectors are constructed, and the feature vectors are clustered using the K-means clustering algorithm to generate trajectory groups with different offset levels; Calculate the mean and standard deviation of the offset distance of all trajectory segments within each trajectory group, and determine the trajectory offset metric value corresponding to each group by a linear combination of the mean and standard deviation.

5. The information system operation and maintenance management method based on bastion host and artificial intelligence according to claim 1, characterized in that, S4 includes: The mouse movement distance sequence within each time period is analyzed from the trajectory offset metric, and the instantaneous operation speed is obtained by calculating the ratio of the distance difference between adjacent time points to the time interval. Perform a differential operation on the instantaneous operating speed to generate a numerical value of the operating speed change; Extract the dwell time data for the corresponding time period from the dwell time record of the screen operation area, and construct a dataset that pairs speed change with dwell time; Calculate the correlation coefficient of the paired dataset. If the absolute value of the correlation coefficient exceeds a preset threshold, extract the absolute value of the speed change and the increment of the dwell time relative to the baseline time within that period. Calculate the ratio of the absolute value of the speed change to the increment of the dwell time within each time window, and generate a record of the ratio of the correlation between the change in operating speed and the extension of dwell time.

6. The information system operation and maintenance management method based on bastion host and artificial intelligence according to claim 1, characterized in that, S5 include: The mean and standard deviation of the ratio are calculated based on the statistical distribution of historical normal operation data. The dynamic critical value is determined by adding the standard deviation of the mean to a preset multiple. The ratio of the correlation between speed change and dwell time extension is monitored by a sliding window. If the number of consecutive ratio data points in the window exceeds a preset value and is higher than the dynamic threshold, the time period is marked as high risk of misoperation; otherwise, it is marked as normal change. Based on the labeled results, a corresponding risk level label is assigned to each time period, generating a label record containing time information and risk level.

7. The information system operation and maintenance management method based on bastion host and artificial intelligence according to claim 1, characterized in that, S6 include: User operation behavior records are classified and statistically analyzed based on risk level labels. The false positive rate and false negative rate under each risk level are calculated. The current performance evaluation index value is generated by calculating the weighted sum of the false positive rate and false negative rate. Compare the current performance evaluation index value with the expected threshold. If the current performance evaluation index value is lower than the expected performance threshold, adjust the dynamic threshold value according to the difference between the false alarm rate and the false alarm rate. When the false alarm rate is greater than the false alarm rate, increase the dynamic threshold value, and vice versa, decrease the dynamic threshold value to obtain the adjusted dynamic threshold value. Historical operation records are re-identified using the adjusted dynamic threshold, and new performance evaluation index values ​​are calculated. The dynamic threshold is iteratively adjusted using the gradient descent method until the performance evaluation index converges, generating the optimized dynamic threshold. Based on the optimized dynamic threshold, and combined with the feature differences of different time periods and operation scenarios, a multi-dimensional threshold combination including basic threshold and scenario threshold is constructed. The combination effect is evaluated through cross-validation, and the parameter set with the highest recognition accuracy is selected as the optimized dynamic threshold combination.

8. The information system operation and maintenance management method based on bastion host and artificial intelligence according to claim 7, characterized in that, In S6, the basic threshold value serves as a global reference standard applicable to all scenarios; the scenario threshold value is fine-tuned for different time periods such as working hours, non-working hours, system maintenance windows, as well as different scenarios such as database operations, file system operations, and network configurations.

9. The information system operation and maintenance management method based on bastion host and artificial intelligence according to claim 1, characterized in that, S7 includes: Based on the risk level label of the current operation, select the corresponding critical value parameter from the optimized critical value combination. The high-risk label corresponds to the lower limit critical value of the critical value combination, and the normal change label corresponds to the upper limit critical value of the critical value combination. If the operation record belongs to the high-risk label and the feature value exceeds the lower limit threshold, the real-time alert response mechanism will be triggered to perform alarm notification and access control operations and generate a high-risk handling record. Maintain standard monitoring for normal change label records, record operation time and type, and generate standard monitoring records; Integrate high-risk handling records and standard monitoring records to generate operation and maintenance management results.

10. An information system operation and maintenance management system based on bastion hosts and artificial intelligence, characterized in that, It employs the method described in any one of claims 1-9, comprising: The data acquisition and preprocessing module is used to acquire records of keyboard keystroke intervals, mouse movement positions, and screen operation area dwell times, and generate standardized user operation behavior records. The preliminary anomaly identification module is used to perform time-series analysis on the standardized user operation behavior records, identify the response delay time in the keyboard keystroke interval time records, and generate a preliminary anomaly identification result based on the comparison of the response delay time with a preset threshold. The trajectory offset analysis module is used to combine the preliminary identification results of the behavior anomaly with the mouse movement position record to generate comprehensive operation trajectory data, classify the trajectory according to the coordinate offset distance, and generate groups of different offset levels and corresponding trajectory offset measurement values. The correlation analysis module is used to extract the operation speed change value from the trajectory offset metric value and combine it with the screen operation area dwell time record to generate a ratio record of the correlation between speed change and dwell time extension. The risk assessment module is used to perform threshold judgment on the ratio records, identify abnormal patterns that are continuously higher than the dynamic critical value, and generate risk level labels. The threshold optimization module is used to classify and statistically analyze user operation behavior records according to the risk level labels, calculate performance evaluation index values ​​based on the false alarm rate and false negative rate under each risk level, and adjust the dynamic threshold value according to the performance evaluation index value to generate an optimized dynamic threshold value combination. The differentiated response strategy execution module is used to select the dynamic threshold value corresponding to the risk level label from the optimized dynamic threshold value combination, apply it to the bastion host system to trigger the differentiated response strategy, and generate operation and maintenance management results.

Images