A method and device for monitoring operation and maintenance based on big data platform

Abstract

The present specification provides an operation and maintenance monitoring method and device based on a big data platform, which is applied to a data center. The method includes the following steps: obtaining operation and maintenance operation commands and their corresponding log data; matching the operation commands with a list of high-risk commands, and determining whether the log data corresponding to the operation commands has similar records within a specific time window of a wide table of operation and maintenance operation data, wherein the wide table of operation and maintenance operation data is used to clear similar operation commands within a characteristic time window; if the log data does not have similar records within a specific time window, performing a risk scoring operation on the log data; if the risk score reaches a risk threshold, performing an abnormal alarm operation. Through this method, high-risk operations can be identified, and operation commands that have caused abnormal alarms multiple times can be filtered. In addition, expert experience can be formed based on word vectors to guide the operation commands input by users to avoid major enterprise accidents caused by abnormal human operations.

Description

Technical Field

[0001] This specification relates to the field of big data platform operation and maintenance technology, which can be used in the financial field, and in particular, is a method and device for monitoring operation and maintenance based on a big data platform. Background Art

[0002] As data centers become increasingly large, the number of servers is growing exponentially. O&M operations now reach hundreds of thousands per day and are distributed across multiple platforms. Such a large number of operations has brought great risks and pressure to production systems.

[0003] Operation and maintenance personnel usually operate through the main control console or the main control center to monitor the production environment of the data center. However, since human operation will inevitably lead to operational errors, it is not uncommon for enterprises to have some major accidents. Monitoring and reminding some high-risk operations during manual operation is an urgent problem to be solved. Summary of the invention

[0004] The purpose of the embodiments of this specification is to provide an operation and maintenance monitoring method, device, equipment and medium based on a big data platform, which is suitable for data centers in the financial field, such as data centers suitable for use in banks, to solve the problem of abnormal human operations in the prior art, which may cause major accidents in enterprises.

[0005] To achieve the above objectives, on the one hand, an embodiment of this specification provides an operation and maintenance monitoring method based on a big data platform, which is applied to a data center, and the method includes the following steps:

[0006] Obtain operation commands and their corresponding log data for operation and maintenance;

[0007] Match the operation command with the high-risk command list. If the match is successful, determine whether there is a similar record in the log data corresponding to the operation command within a specific time window of the operation and maintenance operation data wide table, wherein the operation and maintenance operation data wide table is used to clear similar operation commands within a characteristic time window;

[0008] If there is no similar record in the log data within the specific time window, performing a risk scoring operation on the log data;

[0009] If the risk score reaches the risk threshold, an abnormal alarm operation is performed.

[0010] According to one aspect of this embodiment, the step of obtaining the operation command of operation and maintenance and the corresponding log data further includes:

[0011] The operation command is cleaned to remove the operation command parameters carried by the operation command to obtain a single operation command.

[0012] According to one aspect of this embodiment, the operation command parameters include at least part or all of the following: a whitelist script, a password, and digital text.

[0013] According to one aspect of this embodiment, matching the operation command with the high-risk command list further includes:

[0014] Perform word segmentation processing on the single operation command;

[0015] Matching the segmented single operation command with the high-risk command list;

[0016] If the match fails, the data center is ordered to execute the single operation command.

[0017] According to one aspect of this embodiment, the data center stores UMS user application logs, CMDB configuration information, monitoring logs, SD event tables, SD change tables, and human resource tables, and the log data includes operation time, server IP, and operator; the UMS user application logs are obtained according to the operator;

[0018] Before determining whether the log data corresponding to the operation command has similar records within a specific time window of the operation and maintenance operation data wide table, the method further includes:

[0019] Obtain the application corresponding to the CMDB configuration information according to the server IP; obtain the abnormal alarm operation time sheet of the monitoring log according to the server IP and the operation time; obtain the SD event table and the SD change table according to the server IP and the operation time; obtain the job grade information in the human resources table according to the operator.

[0020] According to one aspect of the present embodiment, the step of judging whether the log data is similar within the time window based on the wide table of operation and maintenance operation data further includes: determining the judgment type of the wide table of operation and maintenance operation data, determining the data element type and parameters of the log data, and judging whether the log data is similar within the time window in combination with the preset matching rules and the judgment type; wherein the judgment type includes a monitoring log table judgment type, an SD event table judgment type, a UMS user application table judgment type, an SD change table judgment type and a UMS user change table judgment type; the data element type includes at least one or more of the operation time, the server IP and the operator.

[0021] According to one aspect of this embodiment, the step of performing a risk scoring operation further includes:

[0022] Execute risk scoring based on the log data and the corresponding operation commands;

[0023] The risk score = command risk score * operation time risk score * operation application risk score * operator risk score;

[0024] Among them, the command risk score is determined according to the command risk type corresponding to the operation command, the operation time risk score is determined according to the time interval of the operation time, the operation application risk score is determined according to the type of the application, and the operator risk score is determined according to the rank information of the operator.

[0025] According to one aspect of this embodiment, when the risk score reaches the risk threshold, the step of performing an abnormal alarm operation further includes: the command risk type includes a first risk command, a second risk command, and a third risk command; the time interval includes a first time interval, a second time interval, and a third time interval; the application type includes a first type, a second type, and a third type; the job level information includes a first position, a second position, and a third position;

[0026] If the single operation command is the third risk command, and the operation time is the first time interval or the second time interval, and the job grade information is the second position or the third position, then the abnormal alarm operation is performed; or,

[0027] If the single operation command is the second risk command, the operation time is the first time interval, and the type of the application is the first type, then the abnormal alarm operation is performed; or,

[0028] If the single operation command is the second risk command, and the operation time is the first time interval, and the type of the application is the second type, and the job grade information is the second position or the third position, then the abnormal alarm operation is performed; or,

[0029] If the single operation command is the second risk command, and the operation time is the first time interval or the third time interval, and the type of the application is the first type, and the job grade information is the third job, then the abnormal alarm operation is performed.

[0030] According to one aspect of this embodiment, the step of obtaining the operation command of the operation and maintenance and the corresponding log data also includes:

[0031] Extracting the log data within a time period, and dividing the log data into a plurality of texts according to the operation time;

[0032] Segment the text into a plurality of word vectors, obtain the operating environment parameters of the operation command corresponding to the word vectors, use the operating environment parameters as training weights and train the word vectors;

[0033] The cosine similarity of the word vector is obtained, the cosine values ​​between several word vectors are calculated, and several word vector groups whose cosine values ​​are closest to 1 are obtained by parsing to obtain a benchmark command, which is used to guide the operation command.

[0034] The present invention also provides an operation and maintenance monitoring device based on a big data platform, which is applied to a data center, wherein the data center stores a high-risk command list and an operation and maintenance data wide table, wherein the high-risk command list includes a plurality of prohibited operation commands, and the device comprises:

[0035] A receiving unit is used to obtain operation commands of operation and maintenance and their corresponding log data;

[0036] a comparison unit, configured to match the operation command with the high-risk command list;

[0037] The comparison unit is further used to determine whether the log data corresponding to the operation command has similar records within a specific time window of the operation and maintenance operation data wide table;

[0038] Scoring unit, used to perform risk scoring operations;

[0039] The alarm unit is used to perform abnormal alarm operations.

[0040] Scoring unit The present invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory, wherein when the computer program is run by the processor, it executes any command of the operation and maintenance monitoring method based on the big data platform.

[0041] The present invention also provides a computer storage medium on which a computer program is stored. When the computer program is run by a processor of a computer device, it executes the commands of any one of the operation and maintenance monitoring methods based on a big data platform.

[0042] By using the embodiments of this article, high-risk operations can be identified and operation commands that have caused abnormal alarms multiple times can be filtered. In addition, expert experience can be formed based on word vectors to guide the operation commands entered by users to avoid major enterprise accidents caused by abnormal human operations. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the technical solutions in the embodiments of this specification or the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art description. Obviously, the drawings described below are only some embodiments recorded in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative labor. In the drawings:

[0044] Figure 1 A flowchart of an operation and maintenance monitoring method based on a big data platform is shown in this specification;

[0045] Figure 2 The flowchart of the judgment method of the operation and maintenance monitoring method based on the big data platform of this specification is shown;

[0046] Figure 3 A schematic diagram of the structure of an operation and maintenance monitoring device based on a big data platform is shown in this specification;

[0047] Figure 4 The specific structural diagram of the operation and maintenance monitoring device based on the big data platform of this specification is shown;

[0048] Figure 5 A schematic diagram of the structure of a scoring unit of an operation and maintenance monitoring device based on a big data platform of this specification is shown;

[0049] Figure 6 The data flow chart of the operation and maintenance monitoring device based on the big data platform of this specification is shown;

[0050] Figure 7 The data flow chart of the risk scoring unit and the alarm unit of the operation and maintenance monitoring device based on the big data platform of this specification is shown;

[0051] Figure 8 A schematic diagram of the structure of a computer device is shown.

[0052] [Description of Reference Numerals]

[0053] 300. Data Center;

[0054] 301, collection unit;

[0055] 302. Comparison unit;

[0056] 303, scoring unit;

[0057] 304, alarm unit;

[0058] 3001, display module;

[0059] 3002. High-risk command list database;

[0060] 3003. Wide table database for operation and maintenance data;

[0061] 3011, shelling module;

[0062] 3012, word segmentation module;

[0063] 3031, Command Risk Scoring Unit;

[0064] 3032. Operation time risk scoring unit;

[0065] 3033. Operational application risk scoring unit;

[0066] 3034. Operator risk scoring unit;

[0067] 802. Computer equipment;

[0068] 804, processor;

[0069] 806. Memory;

[0070] 808, driving mechanism;

[0071] 810, input / output module;

[0072] 812. Input device;

[0073] 814. Output device;

[0074] 816. Presentation equipment;

[0075] 818. Graphical user interface;

[0076] 820, network interface;

[0077] 822, communication link;

[0078] 824. Communication bus. DETAILED DESCRIPTION

[0079] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments of this specification, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this specification.

[0080] It should be noted that the terms "first", "second", etc. in the specification and claims of this article and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of this article described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, unit, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0081] This specification provides method operation steps as described in the embodiments or flow charts, but more or fewer operation steps may be included based on routine or non-creative work. The order of steps listed in the embodiments is only one way of executing the order of many steps and does not represent the only execution order. When the system or unit product is actually executed, it can be executed in the order of the method shown in the embodiments or the drawings or in parallel.

[0082] It should be noted that the operation and maintenance operation monitoring method and device based on the big data platform in this article can be used in data centers, and can also be used in any field other than data centers. The operation and maintenance operation monitoring device of the big data platform in this article can be integrated with a mobile terminal or a control terminal. The application field of the operation and maintenance operation monitoring method and system based on the big data platform in this article is not limited.

[0083] It should be noted that, in this embodiment,

[0084] UMS (unified message services) is unified messaging service;

[0085] CMDB (Configuration Management Database) is a configuration management database;

[0086] SD (serve data) is service data;

[0087] IP (Internet Protocol) is a network interconnection protocol;

[0088] ID (Identity document) is an identity identification number.

[0089] like Figure 1The flowchart of the operation and maintenance monitoring method based on the big data platform of this embodiment is shown. In this figure, the process of using log data to determine whether the corresponding operation command meets the risk threshold of the risk score and performing abnormal alarm operation after reaching the risk threshold is described, which specifically includes the following process:

[0090] Step 101: Obtain operation commands and corresponding log data of operation and maintenance.

[0091] Step 102, match the operation command with the high-risk command list. If the match is successful, determine whether there are similar records in the log data corresponding to the operation command within a specific time window of the operation and maintenance operation data wide table, where the operation and maintenance operation data wide table is used to clear similar operation commands within a characteristic time window.

[0092] Step 103: If there is no similar record in the log data within the specific time window, a risk scoring operation is performed on the log data.

[0093] Step 104: If the risk score reaches the risk threshold, an abnormal alarm operation is performed.

[0094] As an embodiment of this article, step 101 specifically includes:

[0095] Clean the operation commands of the operation and maintenance. In this step, when the operation command is accepted by the data center, the data center makes a corresponding response, which can be business logic software generated to process the operation command, or log data for the operation and maintenance personnel to view. It should be noted that the operation command carries operation command parameters, where the operation command parameters include shell layer codes such as whitelist scripts, passwords and digital texts. After clearing the operation command parameters, several single operation commands are obtained, and step 102 is executed.

[0096] like Figure 2 The flowchart of the judgment method of the operation and maintenance monitoring method based on the big data platform is shown as an embodiment of this invention, and step 102 specifically includes:

[0097] Step 1021, segment the single operation command.

[0098] Specifically, the Chinese word segmentation component jieba of Python is used to segment several single operation commands, wherein the single operation command is a command to implement a specific function, which can be a deletion command or a loop judgment command. It should be noted that the type of word segmentation component can be replaced according to the actual needs of the application personnel. For example, Java's word segmenter IKAmalysis, Ansj, jcseg can be used, or the word segmentation library Paoding, mmseg4j can be used. That is, any software that can achieve the word segmentation effect should be understood as the scope to be protected by the present invention. After completing the word segmentation of the single operation command, execute step 1022.

[0099] Step 1022, matching the segmented single operation command with the high-risk command list.

[0100] Specifically, a single operation command is matched with a high-risk command list, where the high-risk command list lists a variety of risky operation commands, such as deletion commands, shutdown commands, settlement commands, or change permission commands, to determine whether the single operation command can be matched to the above-mentioned risky operation commands. If the match fails, execute step 1023; if the match succeeds, execute step 1024.

[0101] Step 1023: If the match fails, the data center is instructed to execute a single operation command.

[0102] Specifically, if the match fails, it means that this operation command cannot threaten the data center. The data center can perform corresponding operations according to the instructions of the operation command, and when the data center executes the current operation command, it can save the log data corresponding to the operation command to the database.

[0103] It should be noted that the log data includes the operation time, the server IP that receives the operation command or executes the operation command, and the ID corresponding to the operator. For the convenience of explanation, the ID corresponding to the operator is omitted as the operator in this embodiment.

[0104] Step 1024: If the match succeeds, determine whether there is a similar record in the log data corresponding to the operation command within a specific time window of the operation and maintenance operation data wide table.

[0105] If the match is successful, it means that this operation command will threaten the data center. In this embodiment, the operation commands are divided into six categories according to the final effect, that is, the operation command is input into the data center, and the data center obtains the final effect according to the algorithm logic, including UMS user application log, CMDB configuration information, monitoring log, SD event table, SD change table and human resources table. One or more of them are associated to obtain a wide table of operation and maintenance operation data corresponding to various usage rules, see Table 1. If the operation command needs to obtain one or more of the following monitoring log table, SD event table, UMS user application table, SD table change table or UMS user table change table, then it is necessary to correspond to its judgment rule. For example, according to the operation command, the data in the monitoring log table needs to be obtained. Then it is necessary to determine whether the operator is the same person. The same person mentioned in this article is the person who caused the alarm or the person who closed the alarm in the table, and the operators directly related to the event are all the same operator. The same server IP is the physical address of the server that receives the operation command. The operation time is within eight hours after the abnormal alarm first occurs or within two hours before the abnormal alarm is closed, where the abnormal alarm is the indication of the abnormal alarm operation mentioned in step 104. For the convenience of explanation, the same operator and the same server IP are identified as similar records in this embodiment, similar to the SD timetable, UMS user application form, SD change table, and UMS user change table. The same judgment method can be used in combination with the judgment rules to make similarity judgments.

[0106] As an embodiment of this article, the operation and maintenance personnel can obtain the application corresponding to the CMDB configuration information based on the server IP. CMDB, as a logical database, contains various relationships between configuration items, such as physical relationships, real-time communication relationships, non-real-time communication relationships and dependency relationships. That is, the relationship between the server IP and the application it runs can be obtained based on the above relationships.

[0107] As an embodiment of this article, the operation and maintenance personnel can also obtain the abnormal alarm operation time list of the monitoring log table according to the server IP and the operation time. Through this abnormal alarm operation time list, the specific time window of the operation and maintenance operation data wide table can be obtained.

[0108] As an embodiment of this article, the operation and maintenance personnel can also obtain the SD event table and the SD change table according to the server IP and operation time, wherein the application field of the present invention is the financial field, and the financial field can be narrowed down to the banking financial service field accordingly, and SD means banking service application.

[0109] As an embodiment of this invention, the operation and maintenance personnel also obtain the job grade information in the human resource table according to the operator. In the human resource table, the IP of the operator corresponds to his job grade.

[0110] Table 1

[0111]

[0112] As an embodiment of this invention, the judgment rules can be matched according to the above-mentioned data element types and their parameters, so as to reduce the possibility of the data center repeatedly performing abnormal alarm operations, wherein the data element types include one or more of operation time, server IP and operator. When the operation command meets the judgment rules, the abnormal alarm operation is stopped; when the operation command does not meet the judgment rules, step 103 is executed.

[0113] As an embodiment of this invention, step 103 performs a risk scoring operation on the log data, wherein the risk scoring rules are as follows:

[0114] Risk score = command risk score * operation time risk score * operation application risk score * operator risk score; wherein, the command risk score is determined according to the command risk type corresponding to the operation command; the operation time risk score is determined according to the interval in which the operation time is located; the operation application risk score is determined according to the type of application; the operator risk score is determined according to the rank information of the operator; in the present invention, the command risk type includes a first risk command, a second risk command and a third risk command; the time interval includes a first time interval, a second time interval and a third time interval; the type of the application includes a first type, a second type and a third type; the rank information includes a first position, a second position and a third position.

[0115] As an embodiment of this article, the first risk command, the second risk command and the third risk command can be 3 points, 2 points and 1 point respectively; the first time interval is 8:00-18:00, and its score is 2 points; the second time interval is 6:00-8:00 and 18:00-22:00, and its score is 1.5 points; the third time interval is 22:00-6:00, and its score is 1 point; the first type is a key application, such as a deposit and withdrawal application, which is rated as 1.4 points, the second type is a Class AB application such as a password taking application, which is rated as 1.2 points, and the third type is a Class CD application such as an identity sampling application, which is rated as 1 point. When different applications are running simultaneously on the same server IP, the highest type of application is taken. For example, if the same server runs the first type application and the third type application at the same time, it is rated as 1.4 points; the first position is an assistant, which is rated as 1.2 points, the second position is a manager, which is rated as 1.1 points, and the third position is a general manager, which is rated as 1 point.

[0116] As an embodiment of this invention, step 104 is specifically, according to the above-mentioned multiple scoring types, they are summarized to obtain the following rules: if the single operation command is the third risk command, and the operation time is the first time interval or the second time interval, and the job grade information is the second position or the third position, the risk threshold is reached, and the abnormal alarm operation is performed; or,

[0117] If the single operation command is the second risk command, the operation time is the first time interval, and the type of the application is the first type, and the risk threshold is reached, the abnormal alarm operation is performed; or,

[0118] If the single operation command is the second risk command, and the operation time is the first time interval, and the type of the application is the second type, and the job grade information is the second position or the third position, and the risk threshold is reached, the abnormal alarm operation is performed; or,

[0119] If the single operation command is the second risk command, and the operation time is the first time interval or the third time interval, and the type of the application is the first type, and the job grade information is the third position, the risk threshold is reached, and the abnormal alarm operation is executed.

[0120] It should be noted that this scoring rule is a preferred embodiment. According to the above ideas or thoughts, the embodiments that change the scoring criteria should also fall within the scope of protection of the present invention.

[0121] As an embodiment of this invention, after step 101, the step of obtaining expert experience may also be included:

[0122] Extracting the log data within a time period, and dividing the log data into a plurality of texts according to the operation time, for example, marking a timestamp on the log data each time the log data is obtained;

[0123] Segment the text into a number of word vectors, obtain the operating environment parameters of the operation command corresponding to the word vector, use the operating environment parameters as training weights, and use the upper and lower windows of the current word vector by timestamp as input to train the word vector;

[0124] The cosine similarity of the word vectors is obtained, the cosine values ​​between several word vectors are calculated, and several word vector groups whose cosine is closest to 1 are obtained by parsing, and a benchmark command, i.e., expert experience, is obtained. The benchmark command is used to guide the operation command. For example, when executing a delete instruction, according to expert experience, it is prohibited to use a document editor to modify the script content before executing the script. In this way, operational errors of operation and maintenance personnel who use the data center for the first time are reduced, and malicious attacks on the data center are reduced.

[0125] Through the above method, it is possible to obtain operation commands and determine whether the operation commands pose a high risk to the data center. It is possible to filter the operation commands that have repeatedly caused abnormal alarms in the data center. After obtaining log data in multiple dimensions, expert experience can be formed to guide the operation commands entered by users, so as to avoid major enterprise accidents caused by human operations. Figure 3 What is shown is a schematic diagram of the structure of an operation and maintenance operation monitoring device based on a big data platform according to an embodiment of the present invention. In this figure, the basic structure of the operation and maintenance operation monitoring device based on a big data platform is described, wherein the functional units and modules can be implemented by software, or by general chips or specific chips. Part or all of the functional units and modules can be on the data center 300, or part of them can also be on the control terminal, and operation and maintenance operations and monitoring interactions are performed through cooperation with the data center 300. The device specifically includes: a collecting unit 301, a comparing unit 302, a scoring unit 303 and an alarm unit 304.

[0126] The data center 300 stores a high-risk command list and a wide table of operation and maintenance data.

[0127] The collecting unit 301 is used to obtain operation commands of operation and maintenance and their corresponding log data.

[0128] The comparison unit 302 is used to match the operation command with the high-risk command list; the comparison unit 302 is also used to determine whether the log data corresponding to the operation command has similar records within a specific time window of the operation and maintenance operation data wide table.

[0129] The scoring unit 303 is used to perform a risk scoring operation when there is no similar record in the log data within the specific time window.

[0130] The alarm unit 304 is used to perform an abnormal alarm operation when the risk score reaches a risk threshold.

[0131] Through the settings of the embodiments of this article, combined with the operation and maintenance data wide table usage rules, risk scoring rules, abnormal alarms and the display module 3001 set on the data center 300, real-time and visual control of the data center 300 can be achieved. When an operation command is received, high-risk operation commands can be filtered. When the high-risk operation command cannot be filtered, the risk is scored according to the log data corresponding to the operation command.

[0132] As another embodiment of this article, you can also refer to Figure 4 The specific structural diagram of the operation and maintenance operation monitoring device based on the big data platform shown in the figure, the data center 300 is used to display the abnormal alarm operation result and the risk score on the display module 3001, and the data center is also used to store the high-risk command list and the operation and maintenance operation data wide table in the high-risk command list database 3002 and the operation and maintenance operation data wide table database 3003 respectively;

[0133] As another embodiment of this invention, the collecting unit 301 further includes:

[0134] The shell removal module 3011 is used to clean the operation commands of the operation and maintenance. It should be noted that the operation commands carry operation command parameters, wherein the operation command parameters include shell layer codes such as whitelist scripts, passwords and digital texts. After the operation command parameters are cleared, several single operation commands are obtained;

[0135] The word segmentation module 3012 is used to segment a number of single operation commands, where a single operation command is a command to implement a specific function, which can be a deletion command or a loop judgment command. The word segmentation unit can be Python's Chinese word segmentation component jieba, or Java's word segmenter IKAmalysis, Ansj, jcseg or word segmentation library Paoding, mmseg4j. That is, any software that can achieve the word segmentation effect should be understood as the word segmentation unit 3012.

[0136] The comparison unit 302 is used to match a single operation command with a high-risk command list, wherein the high-risk command list lists a variety of risky operation commands, such as a delete command, a shutdown command, a settlement command, or a change authority command. The comparison unit 302 is used to determine whether a single operation command can match the above-mentioned risky operation commands. When the comparison unit 302 fails to match, the data center 300 is ordered to execute the corresponding operation command, and the result of the failed match is displayed on the display unit. If the match is successful, it means that this operation command will threaten the data center 300. Then the comparison unit 302 determines whether there is a similar record in the log data corresponding to the operation command within a specific time window of the operation and maintenance operation data wide table. In this embodiment, the data center processes operation commands according to the final effect and is divided into six categories, including UMS user application log, CMDB configuration information, monitoring log, SD event table, SD change table, and human resources table. This information is stored in the data center 300. The comparison unit 302 associates one or more of them to obtain the operation and maintenance operation data wide table corresponding to each type of usage rules, and stores the operation and maintenance operation data wide table to the operation and maintenance operation data wide table. The wide table database 3003 of operation data is used. If the operation command needs to obtain one or more of the following, such as a monitoring log table, an SD event table, a UMS user application table, an SD table change table, or a UMS user table change table, then corresponding judgment rules are required. For example, according to the operation command, the data in the monitoring log table needs to be obtained, so it is necessary to determine whether the operator is the same person. The same person mentioned in the present invention is the person who causes the alarm or the person who closes the alarm in the table, and the operators who are directly related to the event can all be the same operator. The same server IP is the physical address of the server that receives the operation command. The operation time is within eight hours of the alarm unit 304 being turned on or within two hours before the alarm unit 304 is turned off. The alarm unit 304 can perform abnormal alarm operations, and the alarm unit can issue a sound indication or communicate with the display module 3001 for display. In this embodiment, the comparison unit 302 identifies the same operator and the same server IP as similar records, similar to the SD time table, UMS user application table, SD change table, and UMS user change table. The comparison unit 302 can use the same judgment method combined with the judgment rules to make similarity judgments.

[0137] As an embodiment of this article, the operation and maintenance personnel can obtain the application corresponding to the CMDB configuration information based on the server IP. CMDB, as a logical database, contains various relationships between configuration items, such as physical relationships, real-time communication relationships, non-real-time communication relationships and dependency relationships. That is, the relationship between the server IP and the application it runs can be obtained based on the above relationships.

[0138] As an embodiment of this article, the collecting unit 301 can also obtain the abnormal alarm operation time list of the monitoring log table according to the server IP and the operation time. Through this abnormal alarm operation time list, the specific time window of the operation and maintenance operation data wide table can be obtained.

[0139] As an embodiment of this article, the collecting unit 301 can also obtain the SD event table and the SD change table according to the server IP and operation time, wherein the application field of the present invention is the financial field, and the financial field can be narrowed down to the banking financial service field accordingly, and SD is a banking service application.

[0140] As an embodiment of this invention, the collecting unit 301 further obtains the job grade information in the human resource table according to the operator. In the human resource table, the IP of the operator corresponds to his job grade.

[0141] As an embodiment of this invention, the collecting unit 301 can match the judgment rules according to the above-mentioned data element types and their parameters, thereby reducing the possibility of the alarm unit 304, wherein the data element types include one or more of operation time, server IP and operator. When the operation command meets the judgment rules, the alarm unit 304 stops executing the abnormal alarm operation. When the operation command does not meet the judgment rules, the scoring unit 303 performs risk scoring.

[0142] like Figure 5 It is a schematic diagram of the structure of the scoring unit of the operation and maintenance monitoring device based on the big data platform in the embodiment of this article;

[0143] As an embodiment of this invention, the scoring unit 303 performs a risk scoring operation on the log data, wherein the scoring rules of the risk scoring of the scoring unit 303 are as follows;

[0144] Risk score = command risk score * operation time risk score * operation application risk score * operator risk score;

[0145] The scoring unit 303 further includes:

[0146] The command risk score scoring module 3031 is used to determine the command risk score according to the command risk type corresponding to the operation command.

[0147] The operation time risk score scoring module 3032 is used to determine the operation time risk score according to the interval in which the operation time is located.

[0148] The operation application risk score scoring module 3033 is used to determine the operation application risk score according to the type of application.

[0149] The operator risk score scoring module 3034 is used to determine the operator risk score according to the operator's rank information.

[0150] In the present invention, the command risk type includes a first risk command, a second risk command and a third risk command; the time interval includes a first time interval, a second time interval and a third time interval; the type of the application includes a first type, a second type and a third type; the job grade information includes a first position, a second position and a third position.

[0151] As an embodiment of this article, the first risk command, the second risk command and the third risk command can be 3, 2 and 1 points respectively; the first time interval is 8:00-18:00, and its score is 2; the second time interval is 6:00-8:00 and 18:00-22:00, and its score is 1.5; the third time interval is 22:00-6:00, and its score is 1; the first type is a key application, such as a deposit and withdrawal application, which is rated as 1.4 points, the second type is a Class AB application such as a password taking application, which is rated as 1.2 points, and the third type is a Class CD application such as an identity sampling application, which is rated as 1. When different applications are running on the same server IP at the same time, the highest type of application is taken. For example, if the first and third types are running on the same server at the same time, it is rated as 1.4 points; the first position is an assistant, which is rated as 1.2 points, the second position is a manager, which is rated as 1.1 points, and the third position is a general manager, which is rated as 1 point.

[0152] As an embodiment of this invention, the scoring unit 303 summarizes the above-mentioned multiple scoring types and obtains the following rules: if the single operation command is the third risk command, and the operation time is the first time interval or the second time interval, and the job grade information is the second position or the third position, and the risk threshold is reached, the scoring unit 303 instructs the alarm unit 304 to perform the abnormal alarm operation; or,

[0153] If the single operation command is the second risk command, the operation time is the first time interval, and the type of the application is the first type, and the risk threshold is reached, the scoring unit 303 instructs the alarm unit 304 to perform the abnormal alarm operation; or,

[0154] If the single operation command is the second risk command, the operation time is the first time interval, the type of the application is the second type, and the job grade information is the second position or the third position, and the risk threshold is reached, the scoring unit 303 instructs the alarm unit 304 to perform the abnormal alarm operation; or,

[0155] If the single operation command is the second risk command, and the operation time is the first time interval or the third time interval, and the type of the application is the first type, and the job grade information is the third position, the scoring unit 303 instructs the execution alarm unit 304 to perform the abnormal alarm operation; and performs the abnormal alarm operation.

[0156] like Figure 6 The data flow chart of the operation and maintenance operation monitoring device based on the big data platform of the embodiment of this invention is shown in this figure. The specific function realization process of the operation and maintenance operation monitoring system based on the big data platform from obtaining the operation command to executing the abnormal alarm operation is described in this figure, wherein, S601, the operation and maintenance personnel input the operation command to the data center 300; S602 the control terminal obtains the operation command input by the operation and maintenance personnel, and simultaneously obtains the log data corresponding to the operation command in the data center 300; S603, after the control terminal completes the collection of the operation command and the corresponding log data, the control terminal matches the operation command with several high-risk commands listed in the high-risk command list stored in the data center 300, and determines whether the match is successful;

[0157] S604, if the match fails, it proves that the operation command will not affect the data center 300; S605 the data center 300 performs the corresponding operation according to the operation command.

[0158] S606, if the match is successful, it proves that the operation command may threaten the normal operation of the data center 300; S607, then the control terminal needs to start to determine whether there are similar records in the specific time window of the operation and maintenance operation data wide table of the log data corresponding to the operation command. First, the control terminal determines which form type the operation command needs to obtain, such as one or more of the monitoring log table, SD event table, UMS user application table, SD table change table or UMS user table change table. Secondly, after the control terminal finishes the judgment, the control terminal judges according to the judgment rules of the operation and maintenance operation data wide table, S607, if it is satisfied, it proves that although the operation command can threaten the data center 300, the effect of the operation command is compliant, or it has been processed once within the time window, and there is no need to repeatedly process the operation command that causes the abnormal alarm operation, S608, the data center directly executes the operation command, S609 If it is not satisfied, it proves that the operation command will affect the operation of the data center 300 to varying degrees, then the control terminal performs a risk scoring operation.

[0159] like Figure 7The data flow chart of the risk scoring unit and the alarm unit of the operation and maintenance operation monitoring device based on the big data platform in the embodiment of this invention is shown. The risk scoring unit 303 scores the operation command according to the risk scoring formula; S701, the risk scoring unit 303 first calculates the command risk type of the operation command and scores it. The risk scoring unit 303 divides the risk type into three categories. For example, when the operation command is to delete, it is regarded as the first risk command, when the operation command is to add, it is regarded as the second risk command, and when the operation command is to modify, it is regarded as the third risk command; S702, after the risk scoring unit 303 completes the command risk type scoring, the risk scoring unit 303 scores the operation time risk score according to the operation time in the log data, wherein the risk scoring unit 303 divides a day into three operation time risk levels; S703, after the operation time risk score scoring is completed, the risk scoring unit 303 scores according to the application expected to be obtained by the operation command. It should be noted that the application may include a deposit and withdrawal application, a password taking application, and an identity sampling application, etc., and the application will be classified according to its importance. S704, after the operation application risk score is scored, the risk scoring unit 303 obtains the job grade information of the operator corresponding to the operation command, and scores according to the job grade information, wherein the risk scoring unit 303 divides the job grades into three categories, such as assistant, manager and general manager. Similarly, it can also be divided according to the level, such as p1-p4, p5-p8 and p9-p12. After the risk scoring unit 303 has scored all the levels; S705, summarize according to the risk scoring formula, if the risk of the operation command If the risk score of the operation command does not reach the risk threshold set by the risk scoring unit 303, the data center 300 executes according to the operation command. If the risk score of the operation command reaches the risk threshold set by the risk scoring unit 303; S706, the risk scoring unit 303 sends an abnormal alarm indication to the alarm unit 304; S707, the alarm unit 304 performs an abnormal alarm operation; S708, if the risk score of the operation command reaches the risk threshold set by the risk scoring unit 303, the risk scoring unit 303 instructs the data center to execute this operation command.

[0160] It should be noted that when performing an abnormal alarm operation, the alarm unit 304 needs to store the alarm time and form a time window corresponding to the wide table of operation data, and also form a time window corresponding to the wide table of operation data when the operation and maintenance personnel contact the abnormal alarm operation. Through the above system, it is possible to obtain the operation command and the corresponding log data, match the operation command that meets the matching rules with the wide table of operation data after matching the high-risk command list, and display the matching process. If the operation command cannot meet the matching rules of the wide table of operation data, it will be scored, and the abnormal alarm operation will be performed according to the scoring situation, ensuring the real-time processing of the operation command that threatens the data center, and providing the operation and maintenance personnel with a visual operation platform.

[0161] like Figure 8 The schematic diagram of the mechanism of a computer device provided in the embodiment of this article is shown. The computer device 802 may include one or more processors 804, such as one or more central processing units (CPUs), and each processing unit may implement one or more hardware threads. The computer device 802 may also include any memory 806, which is used to store any kind of information such as code, settings, data, etc. Non-restrictive, for example, the memory 806 may include any one or more combinations of the following: any type of RAM, any type of ROM, flash memory device, hard disk, optical disk, etc. More generally, any memory may use any technology to store information. Further, any memory may provide volatile or non-volatile retention of information. Further, any memory may represent a fixed or removable component of the computer device 802. In one case, when the processor 804 executes an associated command stored in any memory or a combination of memories, the computer device 802 may perform any operation of the associated command. The computer device 802 also includes one or more drive mechanisms 808 for interacting with any memory, such as a hard disk drive mechanism, an optical disk drive mechanism, etc. The computer device 802 may also include an input / output module 810 (I / O) for receiving various inputs (via input devices 812) and for providing various outputs (via output devices 814). A specific output mechanism may include a presentation device 816 and an associated graphical user interface (GUI) 818. In other embodiments, the input / output module 810 (I / O), the input device 812, and the output device 814 may not be included, and the computer device 802 may be used as a computer device in a network. The computer device 802 may also include one or more network interfaces 820 for exchanging data with other devices via one or more communication links 822. One or more communication buses 824 couple the components described above together.

[0162] The communication link 822 may be implemented in any manner, for example, through a local area network, a wide area network (e.g., the Internet), a point-to-point connection, etc., or any combination thereof. The communication link 822 may include any combination of hardwired links, wireless links, routers, gateway functions, name servers, etc. governed by any protocol or combination of protocols.

[0163] The data center 300, the collection unit 301, the comparison unit 302, the scoring unit 303 and the alarm unit 304 in the embodiment of this invention can all be Figure 8 The computer device.

[0164] Corresponds to Figure 1-Figure 2 and Figure 6-Figure 7The method in this article also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the above method are executed.

[0165] The embodiment of the present invention also provides a computer readable command, wherein when the processor executes the command, the program therein causes the processor to execute the following Figure 1 to Figure 2 and Figure 6 to Figure 7 The method shown.

[0166] It should be understood that in the various embodiments of this document, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this document.

[0167] It should also be understood that in the embodiments of this article, the term "and / or" is only a description of the association relationship of the associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0168] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this article.

[0169] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the above-described systems, units and specific working processes of the units can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0170] In the several embodiments provided herein, it should be understood that the disclosed systems, units and methods can be implemented in other ways. For example, the unit embodiments described above are only schematic, for example, the division of the units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, units or units, or can be electrical, mechanical or other forms of connection.

[0171] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the embodiments of this article.

[0172] In addition, each functional unit in each embodiment of this invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above integrated unit may be implemented in the form of hardware or in the form of software functional unit.

[0173] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this article is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of commands to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of this article. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0174] Specific embodiments are used in this article to illustrate the principles and implementation methods of this article. The description of the above embodiments is only used to help understand the methods and core ideas of this article. At the same time, for general technicians in this field, according to the ideas of this article, there will be changes in the specific implementation methods and application scopes. In summary, the content of this specification should not be understood as a limitation on this article.

Claims

1. A maintenance operation monitoring method based on a big data platform, applied to a data center, characterized in that: The method comprises the following steps: Obtain operation commands and their corresponding log data for operation and maintenance; Match the operation command with the high-risk command list. If the match is successful, determine whether there is a similar record in the log data corresponding to the operation command within a specific time window of the operation and maintenance operation data wide table, and clear the similar operation command in the specific time window of the operation and maintenance operation data wide table; wherein the operation and maintenance operation data wide table is obtained by associating one or more of the UMS user application log, CMDB configuration information, monitoring log, SD event table, SD change table and human resources table; If there is no similar record in the log data within the specific time window, performing a risk scoring operation on the log data; If the risk score reaches the risk threshold, an abnormal alarm operation is performed.

2. The operation and maintenance monitoring method based on a big data platform according to claim 1, characterized in that: The step of obtaining the operation command of the operation and maintenance and the corresponding log data further includes: The operation command is cleaned to remove the operation command parameters carried by the operation command to obtain a single operation command.

3. The operation and maintenance monitoring method based on a big data platform according to claim 2, characterized in that: The operation command parameters include at least part or all of the following contents: a whitelist script, a password, and digital text.

4. The operation and maintenance monitoring method based on a big data platform according to claim 2, characterized in that: Matching the operation command with the high-risk command list further includes: Perform word segmentation processing on the single operation command; Matching the segmented single operation command with the high-risk command list; If the match fails, the data center is ordered to execute the single operation command.

5. The operation and maintenance monitoring method based on a big data platform according to claim 2, characterized in that: The data center stores UMS user application logs, CMDB configuration information, monitoring logs, SD event tables, SD change tables, and human resource tables. The log data includes operation time, server IP, and operator; the UMS user application logs are obtained according to the operator; Before determining whether the log data corresponding to the operation command has similar records within a specific time window of the operation and maintenance operation data wide table, the method further includes: Obtain the application corresponding to the CMDB configuration information according to the server IP; obtain the abnormal alarm operation time sheet of the monitoring log according to the server IP and the operation time; obtain the SD event table and the SD change table according to the server IP and the operation time; obtain the job grade information in the human resources table according to the operator.

6. The operation and maintenance monitoring method based on a big data platform according to claim 5, characterized in that: The step of judging whether the log data is similar within the time window according to the wide table of operation and maintenance operation data further includes: determining the judgment type of the wide table of operation and maintenance operation data, determining the data element type and parameters of the log data, and judging whether the log data is similar within the time window in combination with the preset matching rules and the judgment type; wherein the judgment type includes the monitoring log table judgment type, the SD event table judgment type, the UMS user application table judgment type, the SD change table judgment type and the UMS user change table judgment type; the data element type includes at least one or more of the operation time, the server IP and the operator.

7. The operation and maintenance monitoring method based on a big data platform according to claim 6, characterized in that: The step of performing the risk scoring operation further includes: Execute risk scoring based on the log data and the corresponding operation commands; The risk score = command risk score * operation time risk score * operation application risk score * operator risk score; Among them, the command risk score is determined according to the command risk type corresponding to the operation command, the operation time risk score is determined according to the time interval of the operation time, the operation application risk score is determined according to the type of the application, and the operator risk score is determined according to the rank information of the operator.

8. The operation and maintenance monitoring method based on a big data platform according to claim 7, characterized in that: If the risk score reaches the risk threshold, the step of performing an abnormal alarm operation further includes: the command risk type includes a first risk command, a second risk command and a third risk command; the time interval includes a first time interval, a second time interval and a third time interval; the application type includes a first type, a second type and a third type; the job level information includes a first position, a second position and a third position; If the single operation command is the third risk command, and the operation time is the first time interval or the second time interval, and the job grade information is the second position or the third position, then the abnormal alarm operation is performed; or, If the single operation command is the second risk command, the operation time is the first time interval, and the type of the application is the first type, then the abnormal alarm operation is performed; or, If the single operation command is the second risk command, and the operation time is the first time interval, and the type of the application is the second type, and the job grade information is the second position or the third position, then the abnormal alarm operation is performed; or, If the single operation command is the second risk command, and the operation time is the first time interval or the third time interval, and the type of the application is the first type, and the job grade information is the third job, then the abnormal alarm operation is performed.

9. The operation and maintenance monitoring method based on a big data platform according to claim 5, characterized in that: The step of obtaining the operation command of the operation and maintenance and the corresponding log data also includes: Extracting the log data within a time period, and dividing the log data into a plurality of texts according to the operation time; Segment the text into a plurality of word vectors, obtain the operating environment parameters of the operation command corresponding to the word vectors, use the operating environment parameters as training weights and train the word vectors; The cosine similarity of the word vector is obtained, the cosine values ​​between several word vectors are calculated, and several word vector groups whose cosine values ​​are closest to 1 are obtained by parsing to obtain a benchmark command, which is used to guide the operation command.

10. An operation and maintenance monitoring device based on a big data platform, applied to a data center, characterized in that: The data center stores a high-risk command list and a wide table of operation and maintenance data, wherein the high-risk command list includes a number of prohibited operation commands, and the device includes: A receiving unit is used to obtain operation commands of operation and maintenance and their corresponding log data; A comparison unit is used to match the operation command with the high-risk command list; the comparison unit is also used to determine whether the log data corresponding to the operation command has similar records within a specific time window of the operation and maintenance operation data wide table, and if similar records exist, clear the relevant operation instructions in the operation and maintenance operation data wide table; wherein the operation and maintenance operation data wide table is obtained by associating one or more of the UMS user application log, CMDB configuration information, monitoring log, SD event table, SD change table and human resources table; Scoring unit, used to perform risk scoring operations; The alarm unit is used to perform abnormal alarm operations.

11. A computer device comprising a memory, a processor, and a computer program stored in the memory, characterized in that: When the computer program is executed by the processor, the command of the operation and maintenance monitoring method based on the big data platform according to any one of claims 1 to 9 is executed.

12. A computer storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor of a computer device, the computer program executes commands of the operation and maintenance monitoring method based on a big data platform according to any one of claims 1 to 9.

Images