A monitoring processing method and device

Abstract

The present invention discloses a monitoring processing method and device, and relates to the field of computer technology. A specific implementation of the method includes periodically querying a security event analysis library to obtain the number of security events and the level of security events corresponding to each indicator within a preset time period; calculating the monitoring indicator weight coefficient of each host based on the number of security events and the level of security events based on the importance level of each host, and then obtaining the collection time interval of each monitoring indicator of each host; receiving the heartbeat uploaded by the host, and transmitting back the collection time interval of each monitoring indicator corresponding to the host along with the heartbeat response to adjust the collection time interval of each monitoring indicator of the host. Therefore, the implementation of the present invention can solve the problem of lack of pertinence and long security response time for existing monitoring in big data scenarios.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a monitoring processing method and device. Background Art

[0002] With the development of computer networks and the improvement of informatization, the number of users is increasing, and users' requirements for computer information security are also getting higher and higher. At present, the industry has realized remote monitoring of host security, which can monitor host processes, networks, files and other behavioral information, and collect and summarize the information collected on the terminal for analysis. Once malicious attacks are found, the infected range is locked and an alarm is triggered.

[0003] In the process of implementing the present invention, the inventors found that there are at least the following problems in the prior art:

[0004] Currently, monitoring can only be done on a regular basis. For example, when available resources are limited, data of various monitoring indicators are collected periodically. However, the collection period is subjectively set by security operators and is not targeted. When the range of monitored hosts is too large, such as monitoring of millions of hosts, the amount of collected logs on the end is huge, and most of the data is redundant, which will cause excessive pressure on the gateway and waste of storage resources. In addition, the background data analysis is stressful and delayed, and it is impossible to respond in a timely and secure manner. At the same time, the analysis results are inaccurate and the output effect is minimal. Summary of the invention

[0005] In view of this, an embodiment of the present invention provides a monitoring processing method and device, which can solve the problems of lack of pertinence and long security response time in existing monitoring in big data scenarios.

[0006] To achieve the above-mentioned purpose, according to one aspect of an embodiment of the present invention, a monitoring and processing method is provided, including periodically querying a security event analysis library to obtain the number of security events and the level of security events corresponding to each indicator within a preset time period; calculating the monitoring indicator weight coefficient of each host based on the number of security events and the level of security events based on the importance level of each host, and then obtaining the collection time interval of each monitoring indicator of each host; receiving the heartbeat uploaded by the host, and transmitting back the collection time interval of each monitoring indicator corresponding to the host along with the heartbeat response to adjust the collection time interval of each monitoring indicator of the host.

[0007] Optionally, after adjusting the collection time interval of each monitoring indicator of the host, it includes:

[0008] Receive monitoring indicator collection data uploaded by the host, obtain information about the host with security risks, and then lock the host.

[0009] Optionally, after receiving the heartbeat uploaded by the host, include:

[0010] Obtain the host resource usage and host running version number in the heartbeat to determine whether the host is alive. If so, send back the collection time interval of each monitoring indicator corresponding to the host with the heartbeat response; if not, re-push the client deployment to the host to monitor the host.

[0011] Optionally include:

[0012] Obtain the preset collection weight of each indicator and generate a collection indicator weight matrix;

[0013] According to the number and level of security events, the monitoring indicator weight coefficient of each host is calculated based on the importance level of each host and the collection indicator weight matrix.

[0014] Optionally, before calculating the monitoring indicator weight coefficient of each host based on the importance level of each host and the collection indicator weight matrix, the following steps are included:

[0015] According to the number and level of security incidents, a security incident number matrix is ​​generated for each monitoring indicator corresponding to the security incident level;

[0016] Calling a preset preprocessing model to perform standardization processing on the security event number matrix, so as to calculate the information entropy of each monitoring indicator based on the standardized security event number matrix;

[0017] According to the information entropy of each monitoring indicator, the security event assessment weight coefficient of each monitoring indicator is calculated through the preset evaluation model.

[0018] Optionally, a monitoring indicator weight coefficient of each host is calculated based on the importance level of each host and the collection indicator weight matrix, including:

[0019] Obtain the importance level of the host and obtain the corresponding level collection coefficient;

[0020] According to the level collection coefficient, the security event assessment weight coefficient and the collection indicator weight matrix, a preset weight model is called to calculate the collection weights of various monitoring indicators of the host;

[0021] Based on the collection weights of various monitoring indicators of the host, monitoring indicator weight coefficients of various monitoring indicators of the host are obtained.

[0022] Optionally, based on the collection weights of the various monitoring indicators of the host, a monitoring indicator weight coefficient of each monitoring indicator of the host is obtained, including:

[0023] Arrange the collection weights of the various monitoring indicators of the host in order from small to large, take the middle number as the axis, symmetrically exchange the values ​​on the left and right sides, and obtain the monitoring indicator weight coefficients of the various monitoring indicators of the host;

[0024] Get the collection time interval of each monitoring indicator of each host, including:

[0025] According to the preset collection cycle, the collection time interval is obtained based on the monitoring indicator weight coefficient of each monitoring indicator.

[0026] In addition, the present invention also provides a monitoring and processing device, including a configuration management module, which is used to periodically query the security event analysis library to obtain the number of security events and the level of security events corresponding to each indicator within a preset time period; according to the number of security events and the level of security events, the monitoring indicator weight coefficient of each host is calculated based on the importance level of each host, and then the collection time interval of each monitoring indicator of each host is obtained; a heartbeat management module is used to receive the heartbeat uploaded by the host, and transmit the collection time interval of each monitoring indicator corresponding to the host along with the heartbeat response to adjust the collection time interval of each monitoring indicator of the host.

[0027] An embodiment of the above invention has the following advantages or beneficial effects: the present invention obtains the number of security events and the level of security events corresponding to each indicator within a preset time period by periodically querying the security event analysis library; calculates the monitoring indicator weight coefficient of each host based on the number of security events and the level of security events based on the importance level of each host, and then obtains the collection time interval of each monitoring indicator of each host; receives the heartbeat uploaded by the host, and transmits back the collection time interval of each monitoring indicator corresponding to the host with the heartbeat response, so as to adjust the collection time interval of each monitoring indicator of the host. The technical means solves the problem that when the number of hosts is huge, the redundant host monitoring information causes excessive pressure on the gateway and the service background tracing is not timely, and realizes that when the available resources are limited, it ensures that the host business service is not affected, and dynamically adjusts the host monitoring indicator coefficient of the client on the end, so as to achieve targeted security monitoring and collect effective information, while avoiding redundant collection of information and saving gateway resources and background analysis resources.

[0028] The further effects of the above-mentioned non-conventional optional manner will be described below in conjunction with the specific implementation manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] The accompanying drawings are used to better understand the present invention and do not constitute an improper limitation of the present invention.

[0030] Figure 1 is a schematic diagram of the main flow of the monitoring processing method according to the first embodiment of the present invention;

[0031] Figure 2 is a schematic diagram of the main flow of the monitoring processing method according to the second embodiment of the present invention;

[0032] Figure 3 is a schematic diagram of the main flow of the monitoring processing method according to the third embodiment of the present invention;

[0033] Figure 4 is a schematic diagram of main modules of a monitoring processing device according to a first embodiment of the present invention;

[0034] Figure 5 is a schematic diagram of main modules of a monitoring processing device according to a second embodiment of the present invention;

[0035] Figure 6 is an exemplary system architecture diagram to which embodiments of the present invention may be applied;

[0036] Figure 7 It is a schematic diagram of the structure of a computer system of a terminal device or a server suitable for implementing an embodiment of the present invention. DETAILED DESCRIPTION

[0037] The following is a description of exemplary embodiments of the present invention in conjunction with the accompanying drawings, including various details of the embodiments of the present invention to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present invention. Similarly, for clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0038] Figure 1 is a schematic diagram of the main flow of the monitoring processing method according to the first embodiment of the present invention, such as Figure 1 As shown, the monitoring processing method includes:

[0039] Step S101, periodically query the security event analysis library to obtain the number of security events and the level of security events corresponding to each indicator within a preset time period.

[0040] In some embodiments, the security events stored in the security event analysis library mainly come from two sources: one is from the security event analysis of the industry, which associates the behavior characteristics with the monitoring indicators and stores them in the security event analysis library. The other is from the analysis of the host monitoring information within the enterprise, that is, obtaining the data of various monitoring indicators reported by each host, combining the threat intelligence library, abnormal behavior rule library, security vulnerability library, etc. to perform security analysis and obtain security analysis results, such as vulnerability risk level, vulnerability type, etc.

[0041] Step S102, according to the number of security events and the level of security events, the monitoring indicator weight coefficient of each host is calculated based on the importance level of each host, and then the collection time interval of each monitoring indicator of each host is obtained.

[0042] In some embodiments, step S102 may also obtain a preset collection weight for each indicator to generate a collection indicator weight matrix. According to the number of security events and the level of security events, the monitoring indicator weight coefficient of each host is calculated based on the importance level of each host and the collection indicator weight matrix.

[0043] It should be noted that the collection weight of each indicator can be pre-configured. Assuming that there are n indicators in total for monitoring collection, the weight matrix of each collection indicator is represented by a 1*n-order matrix B:

[0044] B=[b 1 b 2 … b n ]

[0045] Where 0<b i <1, and

[0046] In a further embodiment, before calculating the monitoring index weight coefficient of each host based on the importance level of each host and the collection index weight matrix, the following steps are included:

[0047] According to the number of security events and the level of security events, a security event number matrix corresponding to the security event level of each monitoring indicator is generated. The preset preprocessing model is called to standardize the security event number matrix to calculate the information entropy of each monitoring indicator based on the standardized security event number matrix. Then, according to the information entropy of each monitoring indicator, the security event evaluation weight coefficient of each monitoring indicator is calculated through the preset evaluation model. The specific implementation process includes:

[0048] Assume that the level of security incidents is divided into five levels, namely, 1 ,P 2 ,P 3 ,P 4 ,P 5 Indicates that the importance decreases in order, representing very serious, serious, general, slight, and not serious. There are n indicators for monitoring and collection. The number of security events corresponding to the security event level of each collection indicator is represented by a 5*n-order matrix X, such as:

[0049]

[0050] Among them, x ij Indicates the corresponding P under a certain indicator i The number of level (0≤i≤5) security events.

[0051] Then, the security event number matrix X is standardized and the standardized matrix is ​​recorded as Each element in is:

[0052]

[0053] Among them, min(x i ) represents the minimum value of the i-th index in the X matrix, max(x i ) represents the maximum value under the i-th index in the X matrix.

[0054] After that, calculate the information entropy of each indicator:

[0055]

[0056]

[0057] Finally, the security event evaluation weight coefficient C of each monitoring indicator is calculated through the preset evaluation model. i :

[0058]

[0059] Among them, 0<c i <1, and

[0060] A further embodiment calculates the monitoring indicator weight coefficient of each host based on the importance level of each host and the collection indicator weight matrix, including: obtaining the importance level of the host and obtaining the corresponding level collection coefficient. According to the level collection coefficient, the security event assessment weight coefficient and the collection indicator weight matrix, the preset weight model is called to calculate the collection weight of each monitoring indicator of the host. Based on the collection weight of each monitoring indicator of the host, the monitoring indicator weight coefficient of each monitoring indicator of the host is obtained. The specific implementation process includes:

[0061] Assume that the importance of hosts is divided into four levels, represented by P 0 ,P 1 ,P 2 ,P 3 Indicates that the importance level decreases in sequence, and its collection coefficient is expressed by α 0 ,α 1 ,α 2 ,α 3 , indicating that it satisfies α 0 >α 1 >α 2 >α 3 ,and P 0The system calls the preset weight model to calculate the collection weights of various monitoring indicators:

[0062]

[0063] Among them, 0<d i <1, and

[0064] It is worth noting that, based on the collection weights of the various monitoring indicators of the host, the monitoring indicator weight coefficients of the various monitoring indicators of the host are obtained, including: arranging the collection weights of the various monitoring indicators of the host in order from small to large, taking the middle number as the axis, symmetrically exchanging the left and right values, and obtaining the monitoring indicator weight coefficients of the various monitoring indicators of the host. In other words, the larger the collection weight, the shorter the collection time interval and the faster the collection frequency. The collection weight is sorted from small to large, taking the middle number as the axis, and symmetrically exchanging the left and right values, and the weight coefficient of the monitoring indicator is obtained as w. i .

[0065] In addition, according to the preset collection cycle, the collection time interval is obtained based on the monitoring indicator weight coefficient of each monitoring indicator. Specifically, assuming that the collection cycle is fixed to T, the collection interval time of each collected monitoring indicator is:

[0066] t i =T×w i

[0067] Step S103, receiving the heartbeat uploaded by the host, and transmitting back the collection time interval of each monitoring indicator corresponding to the host along with the heartbeat response to adjust the collection time interval of each monitoring indicator of the host.

[0068] In some embodiments, after receiving the heartbeat uploaded by the host, the host resource usage and the host running version number in the heartbeat can be obtained to determine whether the host is alive. If so, the collection time intervals of various monitoring indicators corresponding to the host are transmitted back with the heartbeat response; otherwise, the client is re-pushed and deployed to the host to monitor the host.

[0069] It can be seen that the present invention monitors the survival of clients on all hosts. For machines where the client is not alive, the client is re-pushed to the end to monitor the host behavior. For hosts where the client is alive normally, the collection time interval of each monitoring indicator corresponding to the host is obtained, and the monitoring indicator collection interval is dynamically adjusted.

[0070] In addition, the present invention can also receive monitoring index collection data uploaded by the host, obtain information about hosts with security risks, and then lock the host. In other words, the impact range of the security incident can be analyzed from the monitoring index collection data uploaded by the host, that is, the host information with security risks, such as IP, device ID information, etc. Thus, the infected host can be locked, and emergency stop loss and alarm can be given in time.

[0071] To summarize, the present invention mainly analyzes the correlation data between recent security events and various security monitoring indicators under the condition of limited available resources, combines the subjective collection indicator weight and the host importance level to calculate the collection weight of each monitoring indicator, and reacts to adjust the collection time interval of each monitoring indicator on the host side, so as to dynamically adjust the collection time interval of each monitoring indicator, achieve effective monitoring, and reduce the pressure on the gateway and background analysis.

[0072] Figure 2 is a schematic diagram of the main process of data storage according to the second embodiment of the present invention. The monitoring processing method may include:

[0073] Step S201, periodically query the security event analysis library to obtain the number of security events and the level of security events corresponding to each indicator within a preset time period.

[0074] Step S202: Generate a security event number matrix of security event levels corresponding to various monitoring indicators according to the number of security events and the levels of security events.

[0075] Step S203, calling a preset preprocessing model to perform standardization processing on the security event number matrix.

[0076] Step S204, calculating the information entropy of each monitoring indicator based on the standardized security event number matrix.

[0077] Step S205, according to the information entropy of each monitoring indicator, the security event assessment weight coefficient of each monitoring indicator is calculated through a preset assessment model.

[0078] Step S206, obtaining the preset collection weight of each indicator and generating a collection indicator weight matrix.

[0079] Step S207, obtaining the importance level of the host and obtaining the corresponding level collection coefficient.

[0080] Step S208, based on the level collection coefficient, the security event assessment weight coefficient and the collection indicator weight matrix, a preset weight model is called to calculate the collection weights of various monitoring indicators of the host.

[0081] Step S209, arranging the collection weights of various monitoring indicators of the host in ascending order, taking the middle number as the axis, symmetrically exchanging the left and right values, and obtaining the monitoring indicator weight coefficients of various monitoring indicators of the host.

[0082] Step S210, according to a preset collection cycle, a collection time interval is obtained based on the monitoring indicator weight coefficient of each monitoring indicator.

[0083] Step S211, receiving the heartbeat uploaded by the host, and obtaining the host resource usage and the host running version number in the heartbeat.

[0084] Step S212, determine whether the host is alive, if so, proceed to step S213, if not, proceed to step S214.

[0085] Step S213, the collection time interval of each monitoring indicator corresponding to the host is transmitted back along with the heartbeat response to adjust the collection time interval of each monitoring indicator of the host.

[0086] Step S214, re-pushing the client deployment to the host to monitor the host.

[0087] Figure 3 It is a schematic diagram of the main process of data query according to the third embodiment of the present invention. The monitoring and processing method is based on a remote monitoring system, that is, a design mode of client monitoring and master control server analyzing and collecting data. The client is deployed on each host. The collection interval of each monitoring indicator of the client on the host side is provided by the master control service. The master control service saves the collection configuration (such as the collection interval) for each type of host. The security event library associates security events with monitoring indicators, and queries the security event library at regular intervals to obtain the number of samples in a preset time period, that is, the number of security events corresponding to the indicator and the level of the security event, and analyzes the number of security events of different security event levels for each monitoring indicator. The collection interval (i.e., frequency) of each indicator on each host is adjusted in combination with the importance level of the host, the preset collection weight of each indicator, etc.

[0088] In addition, the client periodically transmits heartbeats to the master control service. The heartbeats include the client resource usage (i.e., the host resource usage) and the client running version number (i.e., the host running version number). The client survival status on all hosts is monitored. For machines where the client is not alive, the client is re-pushed to the end to monitor the host behavior. For hosts where the client survives normally, the corresponding policy configuration of the host is obtained (i.e., the collection time interval of each monitoring indicator), and the monitoring indicator collection interval is dynamically adjusted.

[0089] Figure 4 Schematic diagram of main modules of the monitoring processing device according to the first embodiment of the present invention. Figure 4 As shown, the monitoring and processing device 400 includes a configuration management module 401 that periodically queries the security event analysis library to obtain the number of security events and the level of security events corresponding to each indicator within a preset time period; calculates the monitoring indicator weight coefficient of each host based on the number of security events and the level of security events based on the importance level of each host, and then obtains the collection time interval of each monitoring indicator of each host; the heartbeat management module 402 receives the heartbeat uploaded by the host, and transmits the collection time interval of each monitoring indicator corresponding to the host along with the heartbeat response to adjust the collection time interval of each monitoring indicator of the host.

[0090] In some embodiments, the configuration management module 401 is further used to:

[0091] Receive monitoring indicator collection data uploaded by the host, obtain information about the host with security risks, and then lock the host.

[0092] In some embodiments, after the heartbeat management module 402 receives the heartbeat uploaded by the host, it includes:

[0093] Obtain the host resource usage and host running version number in the heartbeat to determine whether the host is alive. If so, send back the collection time interval of each monitoring indicator corresponding to the host with the heartbeat response; if not, re-push the client deployment to the host to monitor the host.

[0094] In some embodiments, the configuration management module 401 is further used to:

[0095] Obtain the preset collection weight of each indicator and generate a collection indicator weight matrix;

[0096] According to the number and level of security events, the monitoring indicator weight coefficient of each host is calculated based on the importance level of each host and the collection indicator weight matrix.

[0097] In some embodiments, before the configuration management module 401 calculates the monitoring indicator weight coefficient of each host based on the importance level of each host and the collection indicator weight matrix, it includes:

[0098] According to the number and level of security incidents, a security incident number matrix is ​​generated for each monitoring indicator corresponding to the security incident level;

[0099] Calling a preset preprocessing model to perform standardization processing on the security event number matrix, so as to calculate the information entropy of each monitoring indicator based on the standardized security event number matrix;

[0100] According to the information entropy of each monitoring indicator, the security event assessment weight coefficient of each monitoring indicator is calculated through the preset evaluation model.

[0101] In some embodiments, the configuration management module 401 calculates the monitoring indicator weight coefficient of each host based on the importance level of each host and the collection indicator weight matrix, including:

[0102] Obtain the importance level of the host and obtain the corresponding level collection coefficient;

[0103] According to the level collection coefficient, the security event assessment weight coefficient and the collection indicator weight matrix, a preset weight model is called to calculate the collection weights of various monitoring indicators of the host;

[0104] Based on the collection weights of various monitoring indicators of the host, monitoring indicator weight coefficients of various monitoring indicators of the host are obtained.

[0105] In some embodiments, the configuration management module 401 obtains the monitoring indicator weight coefficient of each monitoring indicator of the host based on the collection weight of each monitoring indicator of the host, including: arranging the collection weights of each monitoring indicator of the host in order from small to large, taking the middle number as the axis, symmetrically exchanging the left and right values, and obtaining the monitoring indicator weight coefficient of each monitoring indicator of the host;

[0106] The configuration management module 401 obtains the collection time interval of each monitoring indicator of each host, including: obtaining the collection time interval based on the monitoring indicator weight coefficient of each monitoring indicator according to a preset collection cycle.

[0107] It should be noted that the monitoring processing method and the monitoring processing device described in the present invention have a corresponding relationship in terms of specific implementation contents, so the repeated contents will not be described again.

[0108] Figure 5 It is a schematic diagram of the main modules of the monitoring and processing device according to the second embodiment of the present invention, including the design mode of the present invention based on the remote monitoring system, that is, the client monitoring and the master control server analyzing the collected data. The master control server calculates the monitoring indicator weight coefficient based on the collection indicator weight, security event weight evaluation, host importance level, etc., so as to obtain the collection time interval of each monitoring indicator. The client is deployed on various hosts, including IDC hosts (including physical machines, Docker, cloud hosts) and OA hosts, and regularly goes to the server to obtain the monitoring indicator weight coefficient, and adjusts the collection time interval of each host monitoring indicator according to the monitoring indicator weight coefficient.

[0109] The client uses light agent monitoring (Agent is a system monitoring software), with limited available resources, works without user awareness, and does not affect the host business. The client's functions are mainly divided into three categories: collection function, log upload function, and self-monitoring degradation function (for example, adjusting the collection time interval of each monitoring indicator). Among them, the collection function is responsible for collecting the following types of monitoring indicators: basic host information (including hardware asset information, operating system information, user information, user group information, host importance level, etc.), network information (including connection information, open port information), file operation information, process information, security log information, startup item information, scheduled task information, historical execution command information, user login information, etc.

[0110] It should be noted that the master control service may include a configuration management module, a security event analysis library, a collection and analysis module, an alarm module, a heartbeat management module, and an agent management module. Among them, the configuration management module is used to calculate the monitoring indicator weight coefficient of each host according to the host importance level, the preset collection weight of each indicator, the number of security events, and the level of security events, and then obtain the collection time interval of each monitoring indicator of each host, and save it in the configuration library according to the importance of different hosts. When the client uploads the heartbeat, the collection time interval of the monitoring indicator is transmitted back to the client along with the heartbeat response, so as to realize the dynamic adjustment of the collection time interval of each monitoring indicator on the host side.

[0111] The heartbeat management module is used for the client to periodically transmit the heartbeat to the master control service. The heartbeat includes the client resource usage (i.e. the host resource usage) and the client running version number (i.e. the host running version number). It monitors the client survival on all hosts. For machines where the client is not alive, the client is re-pushed to the end to monitor the host behavior. For hosts where the client survives normally, the policy configuration corresponding to the host is obtained from the configuration management module (i.e. the collection time interval of each monitoring indicator), and the monitoring indicator collection interval is dynamically adjusted. In addition, the resource usage of the client on each host can be monitored to ensure that the normal business use of the host is not affected.

[0112] The collection and analysis module is used to conduct security analysis on the collection data reported by each host, combined with the threat intelligence library, abnormal behavior rule library, security vulnerability library, etc., to obtain security analysis results, including vulnerability risk level, vulnerability type, etc. Therefore, the number of security events and the level of security events can be associated with relevant collection and monitoring indicators and stored in the security event analysis library. It is also possible to record host information with security risks, such as IP, device ID and other information, and transmit it to the alarm module. Preferably, the host reports the collection data in a preset format (such as collection data in Json format) to the collection and analysis module of the master control service through the data gateway.

[0113] The alarm module is used to notify operators of the impact range of a security incident, lock the infected host based on the IP and device ID information obtained by the collection and analysis module, and take timely emergency measures to stop the loss.

[0114] There are two main sources of security events stored in the security event analysis library. One is from the industry's security event analysis, which associates behavioral features with monitoring indicators and stores them in the security event analysis library. The other is from the collection and analysis module, which is obtained based on the analysis of the host monitoring information within the enterprise, that is, obtaining the data of various monitoring indicators reported by each host, combining the threat intelligence library, abnormal behavior rule library, security vulnerability library, etc. for security analysis, and obtaining security analysis results, such as vulnerability risk level, vulnerability type, etc.

[0115] In addition, the Agent management module is used to maintain Agent version management and upgrade Agent on the host side.

[0116] As a further embodiment, the configuration management module calculates the monitoring index weight coefficient of each host based on the number of security events and the level of security events, the importance level of each host and the collection index weight matrix, and then obtains the specific calculation process of the collection time interval of each monitoring index of each host, including:

[0117] The collection weight of each indicator can be pre-configured. Assuming that there are n indicators in total for monitoring collection, the weight matrix of each collection indicator is represented by a 1*n-order matrix B:

[0118] B=[b 1 b 2 … b n ]

[0119] Where 0<b i <1, and

[0120] Assume that the level of security incidents is divided into five levels, namely, 1 ,P 2 ,P 3 ,P 4 ,P 5 Indicates that the importance decreases in order, representing very serious, serious, general, slight, and not serious. There are n indicators for monitoring and collection. The number of security events corresponding to the security event level of each collection indicator is represented by a 5*n-order matrix X, such as:

[0121]

[0122] Among them, x ij Indicates the corresponding P under a certain indicator i The number of level (0≤i≤5) security events.

[0123] Then, the security event number matrix X is standardized and the standardized matrix is ​​recorded as Each element in is:

[0124]

[0125] Among them, min(x i ) represents the minimum value of the i-th index in the X matrix, max(x i ) represents the maximum value under the i-th index in the X matrix.

[0126] After that, calculate the information entropy of each indicator:

[0127]

[0128]

[0129] Finally, the security event evaluation weight coefficient C of each monitoring indicator is calculated through the preset evaluation model. i :

[0130]

[0131] Among them, 0<c i <1, and

[0132] Assume that the importance of hosts is divided into four levels, represented by P 0 ,P 1 ,P 2 ,P 3 Indicates that the importance level decreases in sequence, and its collection coefficient is expressed by α 0 ,α 1 ,α 2 ,α 3 , indicating that it satisfies α 0 >α 1 >α 2 >α 3 ,and P 0 The system calls the preset weight model to calculate the collection weights of various monitoring indicators:

[0133]

[0134] Among them, 0<d i <1, and

[0135] Arrange the collection weights of the various monitoring indicators of the host in order from small to large, take the middle number as the axis, symmetrically exchange the values ​​on the left and right sides, and obtain the weight coefficient of the monitoring indicator as wi Assuming that the collection period is fixed to T, the collection interval of each monitoring indicator is:

[0136] t i =T×w i

[0137] Finally, the collection configurations corresponding to hosts of different importance (including weight coefficients of monitoring indicators, collection intervals of monitoring indicators, etc.) are saved in the configuration library of the master control server.

[0138] Figure 6 An exemplary system architecture 600 to which the monitoring processing method or monitoring processing device according to the embodiment of the present invention can be applied is shown.

[0139] like Figure 6 As shown, system architecture 600 may include terminal devices 601, 602, 603, network 604 and server 605. Network 604 is used to provide a medium for communication links between terminal devices 601, 602, 603 and server 605. Network 604 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0140] The user can use the terminal devices 601, 602, 603 to interact with the server 605 through the network 604 to receive or send messages, etc. Various communication client applications can be installed on the terminal devices 601, 602, 603.

[0141] The terminal devices 601, 602, 603 may be various electronic devices having a monitoring processing screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0142] The server 605 may be a server that provides various services, such as a background management server (only an example) that provides support for users to use the terminal devices 601, 602, and 603. The background management server may analyze and process the received product information query request and other data, and feed back the processing results (such as target push information, product information - only an example) to the terminal device.

[0143] It should be noted that the monitoring processing method provided in the embodiment of the present invention is generally executed by the server 605 , and accordingly, the computing device is generally arranged in the server 605 .

[0144] It should be understood that Figure 6 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0145] Reference below Figure 7 , which shows a schematic diagram of the structure of a computer system 700 of a terminal device suitable for implementing an embodiment of the present invention. Figure 7 The terminal device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0146] like Figure 7 As shown, the computer system 700 includes a central processing unit (CPU) 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage part 708 into a random access memory (RAM) 703. In the RAM 703, various programs and data required for the operation of the computer system 700 are also stored. The CPU 701, the ROM 702, and the RAM 703 are connected to each other via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0147] The following components are connected to the I / O interface 705: an input section 705 including a keyboard, a mouse, etc.; an output section 706 including a cathode ray tube (CRT), a liquid crystal monitor processor (LCD), etc., and a speaker, etc.; a storage section 708 including a hard disk, etc.; and a communication section 709 including a network interface card such as a LAN card, a modem, etc. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the I / O interface 705 as needed. A removable medium 711, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 710 as needed, so that a computer program read therefrom is installed into the storage section 708 as needed.

[0148] In particular, according to the embodiments disclosed in the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present invention include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 709, and / or installed from the removable medium 711. When the computer program is executed by the central processing unit (CPU) 701, the above-mentioned functions defined in the system of the present invention are executed.

[0149] It should be noted that the computer-readable medium shown in the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0150] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0151] The modules involved in the embodiments of the present invention may be implemented by software or hardware. The modules described may also be arranged in a processor, for example, it may be described as follows: a processor includes a configuration management module and a heartbeat management module. The names of these modules do not, in some cases, constitute limitations on the modules themselves.

[0152] As another aspect, the present invention also provides a computer-readable medium, which may be included in the device described in the above embodiment; or it may exist independently without being assembled into the device. The above computer-readable medium carries one or more programs. When the above one or more programs are executed by a device, the device includes periodic query of the security event analysis library to obtain the number of security events and the level of security events corresponding to each indicator within a preset time period; according to the number of security events and the level of security events, the weight coefficient of the monitoring indicator of each host is calculated based on the importance level of each host, and then the collection time interval of each monitoring indicator of each host is obtained; the heartbeat uploaded by the host is received, and the collection time interval of each monitoring indicator corresponding to the host is transmitted back along with the heartbeat response to adjust the collection time interval of each monitoring indicator of the host.

[0153] The technical solution according to the embodiment of the present invention can solve the problems of lack of pertinence and long security response time in existing monitoring in big data scenarios.

[0154] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may occur depending on design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A monitoring processing method, characterized in that: include: Regularly query the security event analysis database to obtain the number of security events and the level of security events corresponding to each indicator within the preset time period; According to the number and level of security events, the weight coefficient of the monitoring indicators of each host is calculated based on the importance level of each host, and then the collection time interval of each monitoring indicator of each host is obtained; Receive the heartbeat uploaded by the host, and transmit back the collection time interval of each monitoring indicator corresponding to the host along with the heartbeat response to adjust the collection time interval of each monitoring indicator of the host; It also includes: obtaining the preset collection weight of each indicator and generating a collection indicator weight matrix; According to the number and level of security events, the monitoring indicator weight coefficient of each host is calculated based on the importance level of each host and the collection indicator weight matrix.

2. The method according to claim 1, characterized in that After adjusting the collection time interval of each monitoring indicator of the host, including: Receive monitoring indicator collection data uploaded by the host, obtain information about the host with security risks, and then lock the host.

3. The method according to claim 1, characterized in that: After receiving the heartbeat uploaded by the host, it includes: Obtain the host resource usage and host running version number in the heartbeat to determine whether the host is alive. If so, send back the collection time interval of each monitoring indicator corresponding to the host with the heartbeat response; if not, re-push the client deployment to the host to monitor the host.

4. The method according to claim 1, characterized in that Before calculating the monitoring indicator weight coefficient of each host based on the importance level of each host and the collection indicator weight matrix, it includes: According to the number and level of security incidents, a security incident number matrix is ​​generated for each monitoring indicator corresponding to the security incident level; Calling a preset preprocessing model to perform standardization processing on the security event number matrix, so as to calculate the information entropy of each monitoring indicator based on the standardized security event number matrix; According to the information entropy of each monitoring indicator, the security event assessment weight coefficient of each monitoring indicator is calculated through the preset evaluation model.

5. The method according to claim 4, characterized in that The monitoring indicator weight coefficient of each host is calculated based on the importance level of each host and the collection indicator weight matrix, including: Obtain the importance level of the host and obtain the corresponding level collection coefficient; According to the level collection coefficient, the security event assessment weight coefficient and the collection indicator weight matrix, a preset weight model is called to calculate the collection weights of various monitoring indicators of the host; Based on the collection weights of various monitoring indicators of the host, monitoring indicator weight coefficients of various monitoring indicators of the host are obtained.

6. The method according to claim 5, characterized in that Based on the collection weights of various monitoring indicators of the host, the monitoring indicator weight coefficients of various monitoring indicators of the host are obtained, including: Arrange the collection weights of the various monitoring indicators of the host in order from small to large, take the middle number as the axis, symmetrically exchange the values ​​on the left and right sides, and obtain the monitoring indicator weight coefficients of the various monitoring indicators of the host; Get the collection time interval of each monitoring indicator of each host, including: According to the preset collection cycle, the collection time interval is obtained based on the monitoring indicator weight coefficient of each monitoring indicator.

7. A monitoring processing device, characterized in that: include: The configuration management module is used to query the security event analysis library at regular intervals to obtain the number of security events and the level of security events corresponding to each indicator within a preset time period; according to the number of security events and the level of security events, the weight coefficient of the monitoring indicator of each host is calculated based on the importance level of each host, and then the collection time interval of each monitoring indicator of each host is obtained; The heartbeat management module is used to receive the heartbeat uploaded by the host, and transmit the collection time interval of each monitoring indicator corresponding to the host back along with the heartbeat response to adjust the collection time interval of each monitoring indicator of the host; The configuration management module is also used to obtain the preset collection weight of each indicator and generate a collection indicator weight matrix; according to the number of security events and the level of security events, the monitoring indicator weight coefficient of each host is calculated based on the importance level of each host and the collection indicator weight matrix.

8. An electronic device, characterized in that: include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 6.

9. A computer readable medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images