Method, device and electronic device for updating process parameter characteristics

Abstract

A method, device and electronic device for updating process parameter characteristics, the method comprising: adjusting the frequency of collecting process parameter characteristics within a preset period, counting the number of process samples collected within each frequency, arranging the process sample numbers in ascending order, screening out an initial process sample with the largest process sample number, parsing parameter information of each process in the initial process sample, obtaining the parameter characteristics of each process based on the parameter information of each process, and obtaining an initial process characteristic library. By the above method, an initial process sample with the largest process number value is obtained to ensure that parameter characteristics of more processes are obtained, and parameter information of processes that continuously change in the initial process sample is marked. In the process detection stage of the detection container, the process corresponding to the marked parameter information is not matched, thereby improving the efficiency of the process detection of the detection container and reducing false positives of the detection container.

Description

Technical Field

[0001] The present application relates to the fields of cloud security and container security, and in particular to a method, device, and electronic device for updating parameter characteristics of a process. Background Art

[0002] With the development of cloud-native technology, container security has gradually been paid attention to, and process security is an important part of container security.

[0003] At present, in order to determine the security of containers, a method for detecting anomalies in the container environment is adopted. In this method, the detection model of the container control collection process parameter characteristics and performs anomaly detection. The corresponding detection model is updated according to the newly added process so that the detection model collects parameter characteristics. The detection model collects the parameter characteristics of the process at a fixed period and frequency. When the period and frequency remain unchanged, since the frequency of the collected process parameter characteristics has not been screened, the total number of collected process samples is limited, and the parameter characteristics collected based on the total process samples are also limited, resulting in the parameter characteristics of processes not at the above frequency cannot be collected. During detection, the process is judged to be abnormal, resulting in false positives in the detection container.

[0004] Furthermore, when detecting processes in a container that have changes in process behavior or process attributes, parameter information for these processes is recorded during parameter feature collection. Each process corresponds to at least one parameter, including the current process behavior and process attributes. However, due to the fixed cycle and frequency, simply collecting process parameter information is insufficient. During the detection process, some processes in the feature library may be detected as abnormal due to the lack of recorded parameter information, resulting in false positives in the container detection. Summary of the Invention

[0005] The present application provides a method, apparatus, and electronic device for updating process parameter features. By adjusting the frequency of collecting process parameter features, a first collection feature frequency that covers the largest number of processes is selected to obtain an initial process sample with a large number of processes. A more comprehensive initial process feature library is thus obtained based on the large number of initial process samples. When a detection container uses the initial process feature library to detect processes, the detection efficiency of the detection container is improved and false positives of the detection container are reduced.

[0006] In a first aspect, the present application provides a method for updating parameter characteristics of a process, the method comprising:

[0007] Adjust the frequency of collecting process parameter characteristics within a preset period and count the number of process samples collected within each frequency;

[0008] Arrange the process sample quantity values ​​in order from small to large, and select the initial process sample with the largest process sample quantity value, wherein the process sample includes multiple processes;

[0009] Parsing the parameter information of each process in the initial process sample, wherein the parameter information includes process behavior and process attributes;

[0010] The parameter characteristics of each process are obtained according to the parameter information of each process, and an initial process feature library is obtained.

[0011] In one possible design, the parameter characteristics of each process are obtained based on the parameter information of each process, and an initial process characteristic library is obtained, including:

[0012] Collect parameter information of each process, read and record the actual number of changes of parameter information of each process;

[0013] Compare the actual number of changes of each process parameter information with the theoretical number of changes to obtain the category information of each parameter feature in the initial process sample;

[0014] According to the category information of all parameter features, an initial process feature library containing category information is obtained.

[0015] In a possible design, the actual number of changes of each process parameter information is compared with the theoretical number of changes, including:

[0016] Input the actual number of changes in the parameter information of each process into a preset algorithm to obtain a parameter information deviation coefficient of each process, wherein the parameter information deviation coefficient represents the error that exists in the theoretical number of changes allowed for the parameter information of the process and the deviation coefficient is a value not exceeding 1;

[0017] Input the parameter information offset coefficient into the preset formula to obtain the theoretical number of changes in each process parameter information;

[0018] Compare the actual number of changes in each process parameter information with the theoretical number of changes.

[0019] In one possible design, the category information of each parameter feature in the initial process sample includes:

[0020] Determine whether the actual number of changes in the parameter information of each process is less than the theoretical number of changes;

[0021] If so, the process is treated as a normal process;

[0022] If not, the process is regarded as a continuously changing process, the parameter information corresponding to the process is marked, and the process is not matched in the detection phase.

[0023] In a second aspect, the present application provides a device for updating parameter characteristics of a process, the device comprising:

[0024] An adjustment module is used to adjust the frequency of collecting parameter characteristics of the collection process within a preset period and count the number of process samples collected within each frequency;

[0025] A screening module arranges the process sample quantity values ​​in ascending order, and screens out an initial process sample with the largest process sample quantity value, wherein the process sample includes multiple processes;

[0026] A parsing module, which parses the parameter information of each process in the initial process sample, wherein the parameter information includes process behavior and process attributes;

[0027] The acquisition module obtains the parameter characteristics of each process according to the parameter information of each process and obtains the initial process characteristic library.

[0028] In one possible design, the acquisition module is specifically used to collect parameter information of each process, read and record the actual number of changes in the parameter information of each process, compare the actual number of changes in the parameter information of each process with the theoretical number of changes, obtain the category information of each parameter feature in the initial process sample, and obtain the initial process feature library containing category information based on the category information of all parameter features.

[0029] In one possible design, the acquisition module is also used to input the actual number of changes in the parameter information of each process into a preset algorithm to obtain the parameter information offset coefficient of each process, wherein the parameter information offset coefficient represents the error in the theoretical number of changes allowed for the parameter information of the process and the offset coefficient is a value not exceeding 1. The parameter information offset coefficient is input into a preset formula to obtain the theoretical number of changes in the parameter information of each process, and the actual number of changes in the parameter information of each process is compared with the theoretical number of changes.

[0030] In one possible design, the acquisition module is also used to determine whether the actual number of changes in the parameter information of each process is less than the theoretical number of changes. If so, the process is treated as a normal process; if not, the process is treated as a continuously changing process, and the corresponding parameter information of the process is marked, and the process is not matched during the detection phase.

[0031] In a third aspect, the present application provides an electronic device, comprising:

[0032] Memory for storing computer programs;

[0033] The processor is used to implement the above-mentioned method steps for updating parameter characteristics of a process when executing the computer program stored in the memory.

[0034] In a fourth aspect, a computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps for updating parameter characteristics of a process described above are implemented.

[0035] For each of the above-mentioned aspects from the first to the fourth aspects and the technical effects that may be achieved by each of the aspects, please refer to the above-mentioned description of the technical effects that can be achieved by the first aspect or various possible solutions in the first aspect, and no further details will be given here. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 A flowchart of the steps of a method for updating parameter characteristics of a process provided by this application;

[0037] Figure 2 A schematic diagram of the structure of a process parameter feature updating device provided by this application;

[0038] Figure 3 This is a schematic diagram of the structure of an electronic device provided in this application. DETAILED DESCRIPTION

[0039] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail with reference to the accompanying drawings. The specific operating methods in the method embodiments can also be applied to device embodiments or system embodiments. It should be noted that in the description of the present application, "multiple" is understood as "at least two". "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent the following three situations: A exists alone, A and B exist at the same time, and B exists alone. A is connected to B, which can represent the following two situations: A is directly connected to B and A is connected to B through C. In addition, in the description of the present application, words such as "first" and "second" are only used to distinguish the purpose of description, and cannot be understood as indicating or implying relative importance, nor can they be understood as indicating or implying order.

[0040] Currently, when a detection container detects a process, the process feature library is based on parameter features collected at a fixed period and frequency. Since the collection frequency of the collected processes is not filtered, it cannot guarantee that the maximum number of processes are covered at the fixed frequency. When a process with other frequencies is detected in the detection container, the detection container does not collect the process when collecting parameter features, resulting in the process being judged as an abnormal process, causing a false positive in the detection container. Moreover, for the features recorded in the detection container's process feature library, the number of times the parameter information of the recorded process changes is limited. When a process consistent with a process in the detection container's process feature library appears, the current parameter information change value of the process is not recorded in the detection container's process feature library, resulting in the process being judged as an abnormal process, causing a false positive in the detection container. Therefore, false positives in the detection container have become a problem that needs to be solved.

[0041] To address the aforementioned issues, this application provides a method for updating process parameter characteristics to reduce false positives in container detection and improve the efficiency of the container detection process. The method and device described in the embodiments of this application are based on the same technical concept. Since the principles of the problems solved by the method and device are similar, the embodiments of the device and method can refer to each other, and any repetitions will not be repeated.

[0042] The embodiments of the present application are described in detail below with reference to the accompanying drawings.

[0043] Reference Figure 1 This application provides a method for updating parameter characteristics of a process. This method can reduce false positives in container detection and improve the efficiency of container detection processes. The implementation process of this method is as follows:

[0044] Step S1: within a preset period, adjust the frequency of collecting parameter characteristics of the collection process, and count the number of process samples collected within each frequency.

[0045] Prior to step S1, parameter characteristics of processes in a mirror with common characteristics are collected in advance in a test environment. Mirrors with common characteristics refer to independent mirrors with fixed running processes, such as database mirrors, message queue mirrors, and gateway mirrors. Parameter characteristics of each process in the mirror with common characteristics are collected, and a process whitelist is formed based on the collected parameter characteristics of each process. The processes in the process whitelist are all normal processes. During the next parameter characteristic collection, parameter characteristics will not be collected for the processes in the process whitelist. The specific method for collecting parameter characteristics of processes in a mirror with common characteristics is consistent with the collection method in the embodiment of the present application. Therefore, the steps for collecting specific parameter characteristics of processes in a mirror with common characteristics can refer to the embodiment of the present application. To avoid repetition, they will not be elaborated here.

[0046] To collect more parameter features, a larger process sample needs to be collected. A process sample includes multiple processes. The number of processes covered by each acquisition frequency for collecting parameter features is different, so the acquisition frequency needs to be adjusted to collect parameter features. In the embodiment of the present application, when the acquisition begins, the acquisition frequency is adjusted, and the number of processes covered at each acquisition frequency is counted. Each acquisition frequency corresponds to a process sample.

[0047] Step S2: Arrange the process sample quantity values ​​in order from small to large, and select the initial process sample with the largest process sample quantity value.

[0048] After obtaining the process quantity value covered by the collection frequency of each collection parameter feature, in order to more quickly filter out the first collection frequency corresponding to the largest process quantity value, it is necessary to determine the quantity value of the process samples corresponding to each collection frequency, and then arrange the process samples in order from small to large quantity value, and filter out the process sample with the largest quantity value. This process sample is the initial process sample.

[0049] By using the above method, an initial process sample with the largest process quantity value is obtained, which ensures the diversity of parameter features obtained according to the initial process sample and ensures that more parameter features can be obtained, thereby reducing false positives in the detection container.

[0050] Step S3: parse out parameter information of each process in the initial process sample, wherein the parameter information includes process behavior and process attributes.

[0051] After obtaining the initial process sample, in order to obtain the parameter characteristics of each process in the initial process sample, the parameter characteristics are obtained through the parameter information of the process, so it is necessary to parse the parameter information of each process. The parameter information includes process line parameter information and process attribute parameter information, wherein the process behavior parameter information can be opening and reading files, network connections, etc., and the process attribute parameter information can be process ID, process execution user, process execution command, process status, etc. The initial process sample includes processes whose parameter information has not changed and processes whose parameter information has changed. The parameter information includes the IP address and port number of the process. In an embodiment of the present application, the parameter characteristics can be represented by a hash value calculated based on the configuration file, network connection, etc. of the command in the parameter information.

[0052] For a process whose parameter information has not changed, the process behavior parameter information and the process attribute parameter information have not changed within the preset period, and the hash value corresponding to the process behavior parameter information and the hash value corresponding to the process attribute parameter information have not changed, then the process whose parameter information has not changed only corresponds to two hash values; the parameter information of a process whose parameter information has changed will change within the preset period, which can be a process whose process behavior parameter information has changed, or a process whose process attribute parameter information has changed, or a process whose process behavior parameter information and process attribute parameter information have both changed; when the process behavior parameter information or the process attribute parameter information of a process changes, the hash value corresponding to the process behavior parameter information or the process attribute parameter information will also change. The change in the parameter characteristics of the process is recorded by recording the hash value of the process. When the calculated hash value is consistent with the recorded hash value, the current hash value is not recorded.

[0053] By using the above method, the parameter information of each process is parsed, and the changes of each process within a cycle are recorded according to the parameter information, so that the parameter characteristics corresponding to each process are collected through the detected parameter information.

[0054] Step S4: Obtain parameter features of each process based on the parameter information of each process to obtain an initial process feature library.

[0055] After obtaining the parameter information of each process, the parameter characteristics of each process can be obtained based on the recorded parameter information of each process. The number of parameter characteristics of each process can be determined from the number of times the recorded parameter information of each process changes. In order to confirm the number of parameter characteristics of each process, it is necessary to obtain the number of times the parameter information of each process changes within a preset period.

[0056] Parameter information of each process is regularly acquired within a preset period according to the first acquisition frequency. The parameter information of each process is recorded each time the parameter information of the process is acquired. The number of actual changes in the parameter information is determined based on whether the multiple parameter information acquired for each process is consistent. The number of actual changes in the parameter information is recorded as shown in Table 1:

[0057]

[0058]

[0059] Table 1

[0060] In the embodiment of the present application, it should be noted that a, b, and c in Table 1 are an array, each of which contains process behavior parameter information and process attribute parameter information, and the change of parameter information varies according to the actual situation. Because in actual conditions, it is possible that the parameter information of process A has not changed, or it is possible that the parameter information of process A has only changed during the second parameter information collection. Due to too many specific situations, they will not be elaborated here.

[0061] In Table 1, it needs to be further explained that the parameter information recorded for process A from the first parameter information collection to the fourth parameter information collection are a1, a2, a3, and a4, respectively. The parameter information of process A changes from a1 to a2, from a2 to a3, and from a3 to a4, indicating that the parameter information of process A has changed three times; the parameter information of process B for the first and second parameter information collections is b1, and the parameter information for the third and fourth parameter information collections is b2. The parameter information of process B changes from b1 to b2, indicating that the parameter information of process B has changed once during the three parameter information collections. Since the actual number of changes in the parameter information of the statistical process is based on the same principle, the actual number of changes in the parameter information of other processes can be confirmed by referring to process A or process B.

[0062] After obtaining the actual number of changes in the parameter information of each process within a preset period, the parameter characteristics corresponding to each process are obtained by calculating the hash value corresponding to the parameter information of each process. After obtaining the parameter characteristics of each process, it is necessary to obtain the category information of the parameter characteristics of each process. The specific process of obtaining the category information is as follows:

[0063] In the embodiment of the present application, the category information of each process needs to be obtained by comparing the actual number of changes in the parameter information with the theoretical number of changes in the parameter information, so the theoretical number of changes in the parameter information needs to be obtained.

[0064] First, the actual number of changes in the parameter information of each process is input into the preset algorithm, and the parameter information offset coefficient of each process is obtained through the preset algorithm. The offset coefficient represents the error in the theoretical number of changes allowed for the parameter information of the process and the offset coefficient is a value not exceeding 1. The parameter information offset coefficient is intended to make the obtained theoretical number of changes in the parameter information closer to the actual number of changes in the parameter information.

[0065] It should be noted that since the parameter information includes process behavior and process attributes, the parameter information offset coefficient includes the process behavior offset coefficient and the process attribute offset coefficient. Therefore, each process has a process behavior offset coefficient and a process attribute offset coefficient. The process behavior offset coefficient and process attribute offset coefficient of each process are independent of each other and do not affect each other.

[0066] In the embodiments of the present application, it should be noted that the preset algorithm is an existing algorithm and will not be elaborated on in detail here.

[0067] After obtaining the parameter information offset coefficient, the process behavior offset coefficient of each process is input into the preset formula to obtain the theoretical number of changes in the process behavior parameter information of each process; the process attribute offset coefficient of each process is input into the preset formula to obtain the theoretical number of changes in the process attribute parameter information of each process. The preset formula is as follows:

[0068]

[0069] Wherein, L is the theoretical number of changes of the parameter information, P is the parameter information offset coefficient, T is the preset period, and F is the first acquisition frequency.

[0070] For example: T is 300s, F is 30s, the actual number of changes in the process behavior parameter information of process A within 300s is 2 times, and the actual number of changes in the process attribute parameter information of process A within 300s is 3 times. The actual number of changes in the parameter information of process A is input into the preset model respectively, and the process behavior offset coefficient of process A is 0.15, and the process attribute offset coefficient of process A is 0.35. 0.15 and 0.35 are input into the preset formula respectively, and the theoretical number of changes in the process behavior parameter information of process A is 1.5 times, and the theoretical number of changes in the process attributes of process A is 3.5 times.

[0071] After obtaining the theoretical number of changes in the process behavior parameter information and the theoretical number of changes in the process attribute parameter information of each process through a preset formula, the theoretical number of changes in the process behavior parameter information of each process is compared with the actual number of changes in the process behavior parameter information of each process; and the theoretical number of changes in the process attribute parameter information of each process is compared with the actual number of changes in the process attribute parameter information. The process category information is determined based on the comparison results. The process category information includes normal processes and processes that are continuously changing. The specific results are as follows:

[0072] Case 1: The actual number of changes in the process behavior parameter information of the process is greater than the theoretical number of changes in the process behavior parameter information; the actual number of changes in the process attribute parameter information is greater than the theoretical number of changes in the process attribute parameter information.

[0073] The process that meets the current situation is regarded as a continuously changing process, and the parameter information of the process is marked. The process is not matched during the detection phase of the detection container.

[0074] Case 2: The actual number of changes in the process behavior parameter information of the process is greater than the theoretical number of changes in the process behavior parameter information; the actual number of changes in the process attribute parameter information is less than the theoretical number of changes in the process attribute parameter information.

[0075] The process that meets the current situation is regarded as a continuously changing process, and the parameter information of the process is marked. The process is not matched during the detection phase of the detection container.

[0076] Case 3: The actual number of changes in the process behavior parameter information of the process is less than the theoretical number of changes in the process behavior parameter information; the actual number of changes in the process attribute parameter information is greater than the theoretical number of changes in the process attribute parameter information.

[0077] The process that meets the current situation is regarded as a continuously changing process, and the parameter information of the process is marked. The process is not matched during the detection phase of the detection container.

[0078] Case 4: The actual number of changes in the process behavior parameter information is less than the theoretical number of changes in the process behavior parameter information; the actual number of changes in the process attribute parameter information is less than the theoretical number of changes in the process attribute parameter information. Processes that meet the current conditions are considered normal processes.

[0079] According to the comparison results, the category information of each process can be obtained. According to the category information of each process, the processes in the initial process sample are classified into two categories: normal processes and continuously changing processes. The initial process feature library is generated according to the recorded processes, process parameter information, hash values ​​corresponding to the process parameter information, and process offset coefficients. At the same time, the process whitelist is placed in the initial process feature library so that the initial process feature library contains more process parameter features.

[0080] Through the method described above, by screening out the first collection frequency with the largest number of covered processes, an initial process sample with the largest number of processes is obtained. Based on the parameter information obtained for each process, parameter features corresponding to the parameter information collected for each process within a period are obtained, thereby forming an initial feature library. This ensures that there are enough processes in the initial process sample, and the diversity of the obtained parameter features is higher. By obtaining the category information of each process, the parameter information of the continuously changing process is marked. During detection, the process corresponding to the marked parameter information does not need to be matched, thereby improving the efficiency of process detection in the detection container and reducing false positives in the detection container.

[0081] Based on the method provided in the present application, within a preset period, the frequency of collecting parameter characteristics of the collection process is adjusted, the number of process samples collected within each frequency is counted, the process sample number values ​​are arranged in order from small to large, and the initial process sample with the largest process sample number value is screened out. Through the above method, the initial process sample with the largest process number value is obtained, ensuring that more parameter characteristics are obtained, and the parameter information of the process that continuously changes in the initial process sample is marked. During the detection stage of the detection container, the process corresponding to the marked parameter information is not matched, thereby improving the efficiency of the detection container in detecting the process and reducing false alarms of the detection container.

[0082] Based on the same inventive concept, the embodiment of the present application also provides a device for updating the parameter characteristics of a process, which is used to implement the function of a method for updating the parameter characteristics of a process, referring to Figure 2 , the device comprises:

[0083] The adjustment module 201 is used to adjust the frequency of collecting parameter characteristics of the process within a preset period, and count the number of process samples collected within each frequency;

[0084] A screening module 202 arranges the process sample quantity values ​​in ascending order, and screens out an initial process sample with the largest process sample quantity value, wherein the process sample includes multiple processes;

[0085] The parsing module 203 parses the parameter information of each process in the initial process sample, wherein the parameter information includes process behavior and process attributes;

[0086] The acquisition module 204 acquires the parameter characteristics of each process according to the parameter information of each process, and obtains an initial process characteristic library.

[0087] In one possible design, the acquisition module 204 is specifically used to collect parameter information of each process, read and record the actual number of changes in the parameter information of each process, compare the actual number of changes in the parameter information of each process with the theoretical number of changes, obtain the category information of each parameter feature in the initial process sample, and obtain the initial process feature library containing category information based on the category information of all parameter features.

[0088] In one possible design, the acquisition module 204 is also used to input the actual number of changes in the parameter information of each process into a preset algorithm to obtain the parameter information offset coefficient of each process, wherein the parameter information offset coefficient represents the error in the theoretical number of changes allowed for the parameter information of the process and the offset coefficient is a value not exceeding 1. The parameter information offset coefficient is input into a preset formula to obtain the theoretical number of changes in the parameter information of each process, and the actual number of changes in the parameter information of each process is compared with the theoretical number of changes.

[0089] In one possible design, the acquisition module 204 is also used to determine whether the actual number of changes in the parameter information of each process is less than the theoretical number of changes. If so, the process is treated as a normal process; if not, the process is treated as a continuously changing process, and the corresponding parameter information of the process is marked, and the process is not matched during the detection stage.

[0090] Based on the same inventive concept, an electronic device is also provided in the embodiment of the present application, which can realize the function of the device for updating the parameter characteristics of the aforementioned process, referring to Figure 3 , the electronic device includes:

[0091] At least one processor 301, and a memory 302 connected to the at least one processor 301. The specific connection medium between the processor 301 and the memory 302 is not limited in the embodiment of the present application. Figure 3 In the example, the processor 301 and the memory 302 are connected via the bus 300. Figure 3 The bus 300 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 3 The diagram is represented by only one thick line, but this does not mean that there is only one bus or one type of bus. Alternatively, the processor 301 may also be referred to as a controller, without limitation to the name.

[0092] In the embodiment of the present application, the memory 302 stores instructions that can be executed by at least one processor 301. At least one processor 301 can execute the method for updating parameter characteristics of a process discussed above by executing the instructions stored in the memory 402. The processor 301 can implement Figure 2 The functions of each module in the device shown.

[0093] Among them, the processor 301 is the control center of the device, which can use various interfaces and lines to connect the various parts of the entire control device, and monitor the device as a whole by running or executing instructions stored in the memory 302 and calling data stored in the memory 302, the various functions of the device and processing data.

[0094] In one possible design, processor 301 may include one or more processing units. Processor 301 may integrate an application processor and a modem processor. The application processor primarily processes the operating system, user interface, and application programs, while the modem processor primarily handles wireless communications. It is understood that the modem processor may not be integrated into processor 301. In some embodiments, processor 301 and memory 302 may be implemented on the same chip. In some embodiments, they may also be implemented on separate chips.

[0095] The processor 301 can be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, and can implement or execute the various methods, steps, and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the parameter feature update method of a process disclosed in the embodiments of the present application can be directly embodied as being executed by a hardware processor, or can be executed by a combination of hardware and software modules in the processor.

[0096] The memory 302 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 302 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 302 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 302 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0097] By designing and programming the processor 301, the code corresponding to the parameter feature update method of a process introduced in the above embodiment can be fixed into the chip, so that the chip can execute the code when running. Figure 1 The embodiment shown shows a process parameter feature update step. How to design and program the processor 301 is a technique well known to those skilled in the art and will not be described in detail here.

[0098] Based on the same inventive concept, an embodiment of the present application also provides a storage medium, which stores computer instructions. When the computer instructions are executed on a computer, the computer executes the parameter feature updating method of a process discussed above.

[0099] In some possible implementations, various aspects of the method for updating parameter characteristics of a process provided by the present application can also be implemented in the form of a program product, which includes program code. When the program product is run on an apparatus, the program code is used to enable the control device to execute the steps of the method for updating parameter characteristics of a process according to various exemplary embodiments of the present application described above in this specification.

[0100] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0101] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0102] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0103] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0104] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A method for updating parameter characteristics of a process, characterized in that: include: Adjust the frequency of collecting process parameter characteristics within a preset period and count the number of process samples collected within each frequency; Arrange the process sample quantity values ​​in order from small to large, and select the initial process sample with the largest process sample quantity value, wherein the process sample includes multiple processes; Parsing the parameter information of each process in the initial process sample, wherein the parameter information includes process behavior and process attributes; Obtain parameter features of each process based on the parameter information of each process, and obtain an initial process feature library; The parameter characteristics of each process are obtained according to the parameter information of each process, and the initial process feature library is obtained, including: Collect parameter information of each process, read and record the actual number of changes of parameter information of each process; Comparing the actual number of changes in each process parameter information with the theoretical number of changes to obtain category information for each parameter feature in the initial process sample; wherein the theoretical number of changes is calculated based on the parameter information offset coefficient, the preset period, and the acquisition frequency; According to the category information of all parameter features, an initial process feature library containing category information is obtained.

2. The method according to claim 1, wherein Compare the actual number of changes in each process parameter information with the theoretical number of changes, including: Inputting the actual number of changes in the parameter information of each process into a preset algorithm to obtain a parameter information deviation coefficient of each process, wherein the parameter information deviation coefficient represents the error that exists in the theoretical number of changes allowed for the parameter information of the process and the deviation coefficient is a value not exceeding 1; Input the parameter information offset coefficient into the preset formula to obtain the theoretical number of changes in each process parameter information; Compare the actual number of changes in each process parameter information with the theoretical number of changes.

3. The method according to claim 1, wherein The obtaining of category information of each parameter feature in the initial process sample includes: Determine whether the actual number of changes in the parameter information of each process is less than the theoretical number of changes; If so, the process is treated as a normal process; If not, the process is regarded as a continuously changing process, the parameter information corresponding to the process is marked, and the process is not matched in the detection phase.

4. A device for updating parameter characteristics of a process, characterized in that: The device comprises: An adjustment module is used to adjust the frequency of collecting parameter characteristics of the collection process within a preset period and count the number of process samples collected within each frequency; A screening module arranges the process sample quantity values ​​in ascending order, and screens out an initial process sample with the largest process sample quantity value, wherein the process sample includes multiple processes; A parsing module, which parses the parameter information of each process in the initial process sample, wherein the parameter information includes process behavior and process attributes; The acquisition module obtains the parameter characteristics of each process according to the parameter information of each process and obtains the initial process feature library; Among them, the acquisition module is specifically used to collect parameter information of each process, read and record the actual number of changes of each process parameter information, compare the actual number of changes of each process parameter information with the theoretical number of changes, obtain the category information of each parameter feature in the initial process sample, and obtain the initial process feature library containing category information based on the category information of all parameter features. The theoretical number of changes is calculated based on the parameter information offset coefficient, the preset period and the acquisition frequency.

5. The device according to claim 4, characterized in that The acquisition module is further used to input the actual number of changes in the parameter information of each process into a preset algorithm to obtain the parameter information offset coefficient of each process, wherein the parameter information offset coefficient represents the error in the theoretical number of changes allowed for the parameter information of the process and the offset coefficient is a value not exceeding 1. The parameter information offset coefficient is input into a preset formula to obtain the theoretical number of changes in the parameter information of each process, and the actual number of changes in the parameter information of each process is compared with the theoretical number of changes.

6. The device according to claim 4, characterized in that The acquisition module is also used to determine whether the actual number of changes in the parameter information of each process is less than the theoretical number of changes. If so, the process is regarded as a normal process. If not, the process is regarded as a continuously changing process, and the corresponding parameter information of the process is marked. The process is not matched during the detection phase.

7. An electronic device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the method steps described in any one of claims 1 to 3 when executing the computer program stored in the memory.

8. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps according to any one of claims 1 to 3 are implemented.

Images