Method, apparatus and device for realizing situation awareness and medium

Abstract

Embodiments of the present application disclose a situation awareness implementation method, device, equipment and medium. The method comprises: taking at least two nodes in a system as target nodes, and obtaining risk level data corresponding to each target node respectively; determining the association relationship between the target nodes; for the nodes with a first association relationship in the target nodes, establishing a conditional probability distribution model based on the conditional probability and the risk level data; for the nodes with a second association relationship in the target nodes, establishing a joint probability distribution model based on the joint probability distribution and the risk level data; and performing situation awareness according to the conditional probability distribution model and the joint probability distribution model to obtain a situation awareness result. The above technical solution is used to analyze the association relationship between the target nodes, different probability distribution models are established according to different association relationships, the algorithm difficulty is reduced through the calculation of the probability distribution, and the technical effects of improving the flexibility of situation awareness modeling and reducing the modeling cost are achieved.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of computer technology, and in particular to methods, apparatuses, devices and media for implementing situational awareness. Background Technology

[0002] Situation awareness in risk control scenarios is a common method for modeling complex risk control systems and is a frequently used modeling approach for situation awareness.

[0003] Commonly used situational awareness modeling methods in existing technologies include perception learning-based methods. However, these methods are computationally difficult and complex, and require further investigation for different situational awareness problems, resulting in high costs. Summary of the Invention

[0004] The embodiments of the present invention provide a method, apparatus, device and medium for implementing situational awareness, which can optimize existing situational awareness implementation schemes.

[0005] In a first aspect, embodiments of the present invention provide a method for implementing situational awareness, comprising:

[0006] Use at least two nodes in the system as target nodes and obtain the risk level data corresponding to each target node.

[0007] Determine the association relationship between the target nodes, wherein the association relationship between the target nodes includes a first association relationship and / or a second association relationship, where nodes with the first association relationship belong to different functions and there is data flow between the nodes, and nodes with the second association relationship belong to the same function;

[0008] For the target nodes that have the first association relationship, a conditional probability distribution model is established based on the conditional probability and the risk level data; for the target nodes that have the second association relationship, a joint probability distribution model is established based on the joint probability distribution and the risk level data.

[0009] Situational awareness is performed based on the conditional probability distribution model and the joint probability distribution model to obtain situational awareness results.

[0010] Secondly, embodiments of the present invention provide a situational awareness implementation apparatus, comprising:

[0011] The risk level data acquisition module is used to select at least two nodes in the system as target nodes and obtain the risk level data corresponding to each target node.

[0012] The association relationship determination module is used to determine the association relationship between the target nodes, wherein the association relationship between the target nodes includes a first association relationship and / or a second association relationship, where nodes with the first association relationship belong to different functions and there is data flow between the nodes, and nodes with the second association relationship belong to the same function;

[0013] The probability distribution model building module is used to build a conditional probability distribution model based on the conditional probability and the risk level data for the target nodes that have the first association relationship; and to build a joint probability distribution model based on the joint probability distribution and the risk level data for the target nodes that have the second association relationship.

[0014] The situation awareness result acquisition module is used to perform situation awareness based on the conditional probability distribution model and the joint probability distribution model, and obtain situation awareness results.

[0015] Thirdly, embodiments of the present invention provide a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the situational awareness implementation method provided in embodiments of the present invention.

[0016] Fourthly, embodiments of the present invention provide a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the situational awareness implementation method provided in embodiments of the present invention.

[0017] This invention provides a situational awareness implementation scheme. First, at least two nodes in the system are designated as target nodes, and risk level data corresponding to each target node is obtained. Then, the relationships between the target nodes are determined, including a first relationship and / or a second relationship. Nodes with a first relationship have different functions and data flow between them, while nodes with a second relationship have the same function. Next, for the target nodes with a first relationship, a conditional probability distribution model is established based on conditional probability and risk level data. For the target nodes with a second relationship, a joint probability distribution model is established based on joint probability distribution and risk level data. Finally, situational awareness is performed based on the conditional probability distribution model and the joint probability distribution model to obtain the situational awareness result. By employing the above technical solution to analyze the relationships between target nodes, different probability distribution models are established according to different relationships. The computational probability distribution reduces the algorithmic difficulty, achieving the technical effect of improving the flexibility of situational awareness modeling and reducing modeling costs. Attached Figure Description

[0018] Figure 1A flowchart illustrating a situational awareness implementation method provided in an embodiment of the present invention;

[0019] Figure 2 A flowchart illustrating another method for implementing situational awareness provided in an embodiment of the present invention;

[0020] Figure 3 A structural block diagram of a situational awareness implementation device provided in an embodiment of the present invention;

[0021] Figure 4 This is a structural block diagram of a computer device provided in an embodiment of the present invention. Detailed Implementation

[0022] The technical solution of the present invention will be further described below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are merely for explaining the present invention and not for limiting the present invention. Furthermore, it should be noted that, for ease of description, only the parts related to the present invention are shown in the drawings, not the entire structure.

[0023] Before discussing the exemplary embodiments in more detail, it should be noted that some exemplary embodiments are described as processes or methods depicted as flowcharts. Although the flowcharts describe the steps as sequential processes, many of these steps can be performed in parallel, concurrently, or simultaneously. Furthermore, the order of the steps can be rearranged. The process can be terminated when its operation is complete, but may also have additional steps not included in the figures. The process can correspond to a method, function, procedure, subroutine, subroutine, etc.

[0024] Example 1

[0025] Figure 1 This is a flowchart illustrating a situational awareness implementation method provided by an embodiment of the present invention. This method can be executed by a situational awareness implementation device, which can be implemented by software and / or hardware, and is generally integrated into computer equipment such as a server. Figure 1 As shown, the method includes:

[0026] S110. Select at least two nodes in the system as target nodes and obtain the risk level data corresponding to each target node.

[0027] The system can represent the architectural system or business system of each enterprise, such as a bank risk control system, an enterprise employee login system, and a product sales system. Within the system, depending on the enterprise's needs, there are multiple functional subsystems. Data flows between nodes in related functional subsystems, and also between different nodes in the same functional subsystem.

[0028] When at least two nodes in the system are selected as target nodes, the target nodes must satisfy at least the following relationship: they are nodes from related different functional subsystems or different nodes from the same functional subsystem. In this embodiment of the invention, the at least two target nodes are target nodes that have a direct association relationship.

[0029] Before acquiring the target node, each node in the system has corresponding risk level data. This risk level data can be obtained from historical assessments or from real-time system assessments. The risk level can be categorized as: no risk, medium risk, and high risk. Correspondingly, 0 can represent no risk, 1 represents medium risk, and 2 represents high risk. The specific format for representing the risk level is not limited here.

[0030] S120. Determine the relationships between target nodes.

[0031] The relationships between target nodes can be determined based on the data flow of the target nodes. These relationships include a first relationship and / or a second relationship. Nodes with a first relationship belong to different functions and have data flow between them, while nodes with a second relationship belong to the same function.

[0032] For example, taking the email function in an enterprise system, data from login node a in email login sub-function A flows to statistics node b in email statistics sub-function B, and data from statistics node b flows to forwarding node c1 in email forwarding sub-function C. Currently, login node a and statistics node b belong to different functions and have a data flow relationship between them. Statistics node b and forwarding node c1 also belong to different functions and have a data flow relationship between them; that is, the relationship between these two pairs of nodes is a first-order association. However, the data flow between node a and node c1 is indirect and can be disregarded; that is, node a and node c1 cannot have a first-order association. In email forwarding sub-function C, if forwarding node c1 is called a first-level forwarding node, after the first-level forwarding node completes its work, data flows to the second-level forwarding node c2, and the second-level forwarding node forwards the data. Therefore, the current first-level forwarding node c1 and second-level forwarding node c2 belong to the same function but different nodes, and the relationship between these nodes is a second-order association.

[0033] It should be noted that the relationship between target nodes may have a primary relationship, a secondary relationship, or both, depending on the data flow of the target nodes in the system.

[0034] S130. For the target nodes with the first correlation, establish a conditional probability distribution model based on conditional probability and risk level data; for the target nodes with the second correlation, establish a joint probability distribution model based on joint probability distribution and risk level data.

[0035] Based on step S110, risk level data for each target node is obtained. Based on step S120, the correlation between target nodes is obtained. For nodes with a first correlation, a conditional probability distribution model is established based on conditional probability and risk level data. For nodes with a second correlation, a joint probability distribution model is established based on joint probability distribution and risk level data.

[0036] For example, for nodes a and b with different functions, the conditional probability distribution model is P(b|a); for nodes c1 and c2 with the same function, the joint probability distribution model is P(c1,c2).

[0037] S140. Conduct situational awareness based on the conditional probability distribution model and the joint probability distribution model to obtain situational awareness results.

[0038] According to embodiments of the present invention, a situational awareness method is provided. The obtained situational awareness result can be a risk level value calculated by analyzing different flow directions of data from a target node using a conditional probability distribution model and a joint probability distribution model. The magnitude of the risk level value indicates the level of risk of the current node.

[0039] Furthermore, it can be used to predict the probability of risks occurring at nodes generated in the system at future points in time. If the predicted risk probability values ​​of some nodes are larger, it can be considered that the possibility of risk occurring is greater, and corresponding early warning mechanisms can be adopted to prevent the risk from occurring.

[0040] The situational awareness method provided in this embodiment of the invention first identifies at least two nodes in the system as target nodes and acquires risk level data corresponding to each target node. Then, it determines the relationships between the target nodes, including a first relationship and / or a second relationship. Nodes with a first relationship have different functions and data flow between them, while nodes with a second relationship have the same function. Next, for the target nodes with a first relationship, a conditional probability distribution model is established based on conditional probability and risk level data. For the target nodes with a second relationship, a joint probability distribution model is established based on joint probability distribution and risk level data. Finally, situational awareness is performed based on the conditional probability distribution model and the joint probability distribution model to obtain the situational awareness result. By employing the above technical solution to analyze the relationships between target nodes, different probability distribution models are established according to different relationships. The calculation of probability distributions reduces the algorithmic difficulty, thereby improving the flexibility of situational awareness modeling and reducing modeling costs.

[0041] Example 2

[0042] This invention further optimizes the above embodiments by improving the step of establishing a conditional probability distribution model based on conditional probability and risk level data for nodes with the first association relationship among the target nodes. The optimization includes: for a first type of node with the first association relationship among the target data nodes, obtaining the first datasets corresponding to each of the first type of nodes; using the time period with data transmission flow between the first datasets as a first target time period, dividing the datasets corresponding to the first target time period using a first preset time interval to obtain multiple first data segments; determining the risk level corresponding to each first data segment using a first preset rule, and establishing a conditional probability distribution model based on the risk level corresponding to each first data segment. The advantage of this approach is that it considers the unidirectional transmission characteristics of data by analyzing the first type of nodes based on the association relationship between target data and establishing a conditional probability distribution model.

[0043] The method further optimizes the step of establishing a joint probability distribution model based on the joint probability distribution and the risk level data for nodes in the target nodes that have the second association relationship. This includes: for the second type of nodes in the target data nodes that have the second association relationship, obtaining the second datasets corresponding to each of the second type of nodes; using the time period where there is a data association between the second datasets as the second target time period, dividing the datasets corresponding to the second target time period using a first preset time interval to obtain multiple second data segments; determining the risk level corresponding to each second data segment using a second preset rule, and establishing a joint probability distribution model based on the risk level corresponding to each second data segment. The advantage of this setup is that it analyzes the second type of nodes based on the association relationship between the target data and establishes the joint probability distribution model, taking into account the bidirectional data transmission characteristics.

[0044] The steps for performing situational awareness based on the conditional probability distribution model and the joint probability distribution model to obtain situational awareness results are further optimized. These steps include: predicting the expected value of the risk level of the node to be evaluated at a future time point based on the node to be evaluated at the current time point and its corresponding risk level, wherein the time interval between the future time point and the current time point is a first preset time interval; predicting the first risk level of the node to be evaluated at a future time point based on the conditional probability distribution model and the risk level of the first type of node corresponding to the node to be evaluated at the current time point; predicting the second risk level of the node to be evaluated at a future time point based on the joint probability distribution model and the risk level of the second type of node corresponding to the node to be evaluated at the current time point; and calculating the situational awareness result of the node to be evaluated at a future time point using a preset method based on the expected value of the risk level corresponding to the node to be evaluated, the first risk level, and the second risk level. The advantage of this setup is that different probability models are used for calculation based on different characteristics of the data, which reduces the complexity of situational awareness modeling.

[0045] like Figure 2 As shown, Figure 2 The following is a flowchart illustrating another method for implementing situational awareness according to an embodiment of the present invention. Specifically, the method includes the following steps:

[0046] S210. Obtain historical data corresponding to nodes within a preset time period, and determine the risk level data corresponding to each node based on the historical data.

[0047] The preset time period can be determined based on the amount of historical data generated by the nodes of the system's historical time period. Accordingly, it can be one hour, one day, or one week, etc., and there is no limitation here.

[0048] The system can classify risk levels and automatically determine the corresponding risk level for the data generated by the system. For example, the risk level can be divided into 0, 1, and 2, where 0 represents no risk, 1 represents medium risk, and 2 represents high risk. Thus, the risk level data corresponding to each node can be determined.

[0049] The situational awareness method provided in this invention can model the acquired nodes before modeling the system. The modeling process can be as follows: First, define the current system as having k types of functions, each type of function having several nodes, denoted as m1, m2, ..., m... k Then the total number of nodes generated by the system within the preset time period is Where i represents the current function in the system, m i This indicates the number of nodes corresponding to the current function. Then, since each node is marked with a corresponding risk level, we can model the changes in the corresponding risk level during the data transmission process for each node.

[0050] For example, select any node m in the system x And find the match with m in historical data. x The data corresponding to the relevant nodes, i.e., node m x During transmission, the corresponding data is passed from the previous node to node m. x In, and by m x The data corresponding to the relevant nodes is transmitted to the next node, and the acquired data is sorted from front to back according to time to obtain the sorted data about m. x Let the data table be denoted as X.

[0051] Since each data entry in data table X has a corresponding risk level, we can count the data transfers from the previous node to the next node, and count the corresponding risk level data transfers. For example, if the label is [0 0 0 1 2 2 1 1 1 0], then the count of transferring from level 0 to level 0 is 2, the count of transferring from level 0 to level 1 is 1, the count of transferring from level 0 to level 2 is 0, the count of transferring from level 1 to level 0 is 1, the count of transferring from level 1 to level 1 is 2, the count of transferring from level 1 to level 2 is 1, the count of transferring from level 2 to level 0 is 0, the count of transferring from level 2 to level 1 is 1, and the count of transferring from level 2 to level 2 is 1, thus obtaining Table 1.

[0052] Table 1. Statistical Table of Risk Level Data Transfer Count

[0053]

[0054]

[0055] In Table 1, the vertical axis R(y) represents the risk level data of the previous data, the horizontal axis R(x) represents the risk level data of the next data, and the others represent the risk level transfer counts.

[0056] Furthermore, by analyzing Table 1, we can see that there are a total of 9 effective transitions. Therefore, all the transition counts in Table 1 are converted into probabilities, resulting in Table 2.

[0057] Table 2 shows the probability distribution corresponding to the risk level data transfer count statistics.

[0058]

[0059] Therefore, based on Table 2, the subsequent deployment phase can be determined by analyzing any node m. x The shift in risk level data lays the groundwork for situational awareness.

[0060] S220. Select at least two nodes in the system as target nodes and obtain the risk level data corresponding to each target node.

[0061] S230. Determine the relationships between target nodes.

[0062] S240. For the first type of nodes with the first association relationship in the target data nodes, obtain the first dataset corresponding to each of the first type of nodes.

[0063] In response to the system, establish information about When designing a network model with a single node, we currently only consider nodes that have different functions and a primary relationship of data flow between them, and these nodes are denoted as the first type of node.

[0064] For example, select the first type of node as m a and m b At that time, data comes from node m a Flow to node m b Thus, m can be found in historical data. a Node-related data and m b The node-related data, sorted chronologically from front to back, yields datasets A and B. Datasets A and B are then the first datasets corresponding to the first type of nodes.

[0065] S241. Take the time period in which there is a data transmission flow between the first datasets as the first target time period, and divide the datasets corresponding to the first target time period using the first preset time interval to obtain multiple first data segments.

[0066] The time period in which data transfer occurs between the first datasets is selected as the first target time period. Here, the data transfer direction can be understood as data flowing from node m in function a. a To node m in function b b Transmission. Because the data flow in and out of a node during data transmission corresponds to the flow and transmission of multiple data streams, therefore, when node m... a Data flows to node m b The amount of data may vary over time. Therefore, when selecting the first target time period, it is necessary to choose a time period with data transmission flow as the first target time period, denoted as [t0, t...]. k ].

[0067] Divide [t0, t] into [t0, t] using the first preset time interval. k The purpose of the corresponding dataset is to divide the dataset into multiple first data segments, thereby analyzing the characteristics of each first data segment to obtain the characteristics corresponding to the current dataset.

[0068] The first preset time interval can be determined based on the amount of data contained in the dataset and the number of first data segments to be obtained, for example, it can be 5s, 30s or 60s, etc., without limitation.

[0069] For example, let the first preset time interval be t. w When t w At 5s, datasets A and B are divided into 5 first data segments. Since the amount of data in each first data segment may not be equal during the data flow, only the risk level data corresponding to the data in each data segment is analyzed. For example, for the 5 first data segments corresponding to dataset A and dataset B, the risk level data corresponding to the data in each first data segment is shown in Table 3.

[0070] Table 3 shows the risk level data corresponding to datasets A and B in the first data segment.

[0071] First data segment Risk level data for dataset A Risk level data for dataset b 1 [0 1 0 2 0] [1 1 0] 2 [1 1 1 2] [0 1] 3 [1 1 1 1 0 0] [1 2 0] 4 [0 0 0 0] [0 0 2 1 1] 5 [0 1 1 1 2] [1 1 2 0]

[0072] Table 3 shows that in the first data segment of the partition, node m a Five data points were generated, and the risk levels corresponding to these five data points are [0 1 0 2 0]. b Three data points were generated, and the risk level data corresponding to these three data points is [1 1 0], and so on.

[0073] S242. Use the first preset rule to determine the risk level corresponding to each first data segment, and establish a conditional probability distribution model based on the risk level corresponding to each first data segment.

[0074] When using the node data generated in step S241 for modeling, it is necessary to unify the data contained in each first data segment. This has the advantage of filtering out representative data and reducing data input. Since the situational awareness method provided in this embodiment is for risk control, a first preset rule is used to determine the risk level corresponding to each first data segment. This first preset rule can be to select the value with the largest corresponding risk level data in each first data segment as the final risk level for each first data segment. For example, for the first first data segment in Table 3, m... a The node's risk level is 2, m b The corresponding risk level is 1, and Table 4 can be derived from Table 3:

[0075] Table 4 shows the risk level data for each first data segment.

[0076]

[0077]

[0078] Because the data is from m a Node inflow m b Therefore, the modeling problem for the first type of node can be transformed into a conditional probability distribution model, that is, calculating the conditional probability distribution of P(B|A), which represents the probability of event B occurring given that event A has occurred. This indicates that the data flow discussed in the current step is unidirectional, meaning data flows from node m in function a. a , flowing into m b The process of nodes involves calculating the probability of risk when data flows from the outflowing function to the inflowing function.

[0079] For example, according to Table 4, m can be... a Data in the node is transferred to m b The data transfer problem within nodes can be transformed into the following probability distribution:

[0080] P(B=0|A=0)=0; P(B=0|A=1)=0; P(B=0|A=2)=0; P(B=1|A=0)=0; P(B=1|A=1) =0; P(B=1|A=2)=2 / 5; P(B=2|A=0)=1 / 5; P(B=2|A=1)=1 / 5; P(B=2|A=2)=1 / 5.

[0081] In the subsequent deployment phase, P(B|A) is used to estimate m. a Node and m bRisk relationships between nodes. It is important to note that P(B|A) is still a valid probability, and all cases must cover the entire sample space, meaning the sum of the probabilities of all cases should equal 1.

[0082] S250. For the second type of nodes with the second association relationship in the target data nodes, obtain the second dataset corresponding to each of the second type of nodes.

[0083] In response to the system, establish information about When designing a network model with a single node, we currently only consider nodes that have the same function and a second association relationship involving data flow between them, and these nodes are denoted as second-class nodes.

[0084] For example, select the second type of node as m c1 and m c2 At that time, data comes from node m c1 Flow to node m c2 This allows us to find m in the historical database. c1 Node-related data and m c2 The node-related data, sorted chronologically from front to back, yields datasets C1 and C2. Datasets C1 and C2 are then the second datasets corresponding to the second type of nodes.

[0085] S251. Take the time period in which the data in the second dataset is related as the second target time period, and divide the dataset corresponding to the second target time period using the first preset time interval to obtain multiple second data segments.

[0086] The second target time period is selected from the time periods where there is a data correlation between the second datasets. Here, data correlation can be understood as data flowing from node m under the same function. c1 To node m c2 The flow process. For example, under the approval function, node m... c1 The data is processed by the first-level leader for approval, and after approval, it flows to the second-level leader's approval node m. c2 middle.

[0087] The reasons for selecting the second target time period and dividing the dataset corresponding to the second target time period using the first preset time interval to obtain multiple second data segments are the same as those for selecting the first target time period and dividing the dataset corresponding to the first target time period using the first preset time interval in step S241, and will not be repeated here.

[0088] Accordingly, assuming that when the datasets C1 and C2 corresponding to the second target time period are divided using the first preset time interval, five corresponding second data segments can be obtained respectively, and the risk level data corresponding to the data in each second data segment are shown in Table 5:

[0089] Table 5 shows the risk level data for datasets C1 and C2 in the second data segment.

[0090] Second data segment <![CDATA[Risk level data of dataset C1]]> <![CDATA[Risk level data of dataset C2]]> 1 [0 1 0 2 0] [1 1 0] 2 [1 1 1 2] [0 1] 3 [1 1 1 1 0 0] [1 2 0] 4 [0 0 0 0] [0 0 2 1 1] 5 [0 1 1 1 2] [1 1 2 0]

[0091] S252. Use the second preset rule to determine the risk level corresponding to each second data segment, and establish a joint probability distribution model based on the risk level corresponding to each second data segment.

[0092] The second preset rule can be the same as the first preset rule, that is, selecting the value with the largest risk level data in each second data segment as the final risk level of each second data segment, thus obtaining Table 6 according to Table 5:

[0093] Table 6 shows the risk level data for each second data segment.

[0094] Second data segment <![CDATA[Risk level of dataset C1]]> <![CDATA[Risk level of dataset C2]]> 1 2 1 2 2 1 3 1 2 4 0 2 5 2 2

[0095] Because of node m c1 and node m c2 Since they have the same function, the modeling problem for the second type of node can be transformed into a joint probability distribution model, that is, to calculate the joint probability distribution of P(C1,C2).

[0096] For example, according to Table 6, m can be... c1 Data in the node is transferred to m c2 The data transfer problem within nodes can be transformed into the following probability distribution:

[0097] P(C1=0, C2=0)=0; P(C1=1, C2=0)=0; P(C1=2, C2=0)=0; P(C1=0, C2=1)=0; )=0; P(C1=2, C2=1)=2 / 5; P(C1=0, C2=2)=1 / 5; P(C1=1, C2=2)=1 / 5; P(C1=2, C2=2)=1 / 5.

[0098] In the subsequent deployment phase, P(C1,C2) is used to estimate m. c1 Node and m c2 Risk relationships between nodes. It should be noted that P(C1,C2) is still a valid probability, and all cases must cover the entire sample space, that is, the sum of the probabilities of all cases should be 1.

[0099] It should be noted that, based on the characteristics of the joint probability distribution, the node m discussed in this step... c1 To node m c2 The data flow is bidirectional, meaning the relationship P(C1|C2) can be calculated based on P(C1,C2), i.e., node mc1 Data C1 flows to node m c2 The risk probability of data C2 can also be used to calculate the relationship P(C2|C1), i.e., the relationship between node m and the risk probability of data C2. c2 Data C2 flows to node m c1 The risk probability of data C1 in the middle.

[0100] S260. Based on the node to be evaluated at the current time point and the corresponding risk level, predict the expected value of the risk level corresponding to the node to be evaluated at a future time point.

[0101] During the deployment phase, the situational awareness implementation method provided in this embodiment of the invention is used to predict risk level data at future time points. Then, the current time point t is selected. new The node to be evaluated is m x By modeling the nodes according to step S210, the risk level data transfer status of each node can be obtained, combined with the current t new Risk level data at each time point, predicting the node m to be evaluated at a future time point. x In t new +t w The expected value of the risk level corresponding to a given time point.

[0102] For example, node m to be evaluated x , in t new If the risk level corresponding to a given time point is 1, then its t new +t w The expected value of the risk level can be expressed as: Let the expected value of the risk level of the node to be evaluated at a future time be risk. x-self-new .

[0103] It should be noted that the time interval between the future time point and the current time point is the first preset time interval. The significance of restricting the time interval between the future time point and the current time point to be equal to the first preset time interval is that if the time interval selected during the training phase is used to build the model for the deployment phase, if the time intervals are inconsistent, it will lead to a large difference in the amount of data between the time intervals, resulting in inaccurate output results when the model is applied during the deployment phase.

[0104] S270. Based on the conditional probability distribution model and the risk level of the first type of node corresponding to the node to be evaluated at the current time point, predict the first risk level of the node to be evaluated at a future time point; based on the joint probability distribution model and the risk level of the second type of node corresponding to the node to be evaluated at the current time point, predict the second risk level of the node to be evaluated at a future time point.

[0105] First, determine the node m to be evaluated. xThe total number of nodes corresponding to the second type of nodes, that is, the node data that has data flow with the node to be evaluated in the same function. Assume that under the same function, there are nodes m... x There is data flow between n second-type nodes, and the data flows based on the data corresponding to these n second-type nodes in time t. new Based on the risk level corresponding to the given time and the joint probability distribution model established in steps S250-S252, predict the node m to be evaluated. x In t new +t w The second risk level at a given time point is denoted as risk. x-sam-new .

[0106] Predict m x In t new +t w The second risk level data at a given time point x-sam-new The process can be as follows: Assume that the node m to be evaluated is known. x nodes c1, c2, and c3 with the same function t new The risk level at any given moment, for example, c1 at time t new If the risk at time t is 1, then the following steps can be used for calculation: a) According to step S260, c1 at time t can be obtained. new +t w a) Determine the risk level based on the expected risk level at any given time and rounding; b) Determine the risk level based on the risk level of c1 and (c1,m) x The joint probability P(m) x =1, c1=1)=1 / 5, P(m x =2, c1=1)=1 / 2, then c1 is associated with m x The expected value of the risk level is 1*1 / 5 + 2*1 / 2 = 1.2; c) Similarly, the expected value of the risk level under the other related nodes c2 and c3 can be obtained. x Given the expected value of the risk level, calculate the average of the expected values ​​of the risk levels under the associated nodes to obtain m. x risk x-sam-new .

[0107] Then, determine the relationship with the node m to be evaluated. x The total number of nodes corresponding to the first type of nodes, i.e., the number of nodes flowing into the node to be evaluated from different functions. Assume there are L different functions, each corresponding to l first-type nodes, whose data flows into the node to be evaluated. Based on the data corresponding to the l first-type nodes at time t... new Based on the risk level corresponding to the given time and the conditional probability distribution model established in steps S240-S242, predict the node m to be evaluated. x In t new +t wThe first risk level at a given time point is denoted as risk. x-diff-new .

[0108] Among them, predict m x In t new +t w The first risk level data at a given time point x-diff-new The process and the above prediction m x In t new +t w The second risk level data at a given time point x-sam-new The process is similar and will not be repeated here.

[0109] S280. Using a preset method, calculate the situational awareness results of the node to be evaluated at future time points based on the expected value of the risk level corresponding to the node to be evaluated, the first risk level, and the second risk level.

[0110] The expected risk level of the node to be evaluated at a future time point is obtained according to step S260. x-self-new According to step S270, the first risk level of the node to be evaluated at a future time point is obtained respectively. x-diff-new Second risk level x-sam-new The situational awareness result can then be calculated using a preset method.

[0111] Preferably, the preset method is represented by the following expression:

[0112]

[0113] In the formula, a and b represent constants, and satisfy a + b = 1; risk x_new This represents the risk level data of the node to be evaluated at a future time point; l represents the total number of nodes in the first category corresponding to the node to be evaluated; n represents the total number of nodes in the second category corresponding to the node to be evaluated; risk x-self-new This represents the expected value of the risk level corresponding to the node to be evaluated at a future point in time; risk x-diff-new This represents the risk level data of the first category of nodes corresponding to the node to be evaluated at a future time point; risk x-sam-new This represents the risk level data of the node to be evaluated and the corresponding second-category node at future points in time.

[0114] When calculating the weighted average, the specific values ​​of a and b can be dynamically adjusted according to the actual data performance. For example, a = 0.5, b = 0.5 or a = 0.4, b = 0.6, etc. The specific values ​​are not limited here.

[0115] Among them, the risk level data of the node to be evaluated at a future time point represents the situational awareness result.

[0116] Furthermore, the situational awareness results for each node to be evaluated can be obtained by predicting the risk level data of all nodes to be evaluated in the system at future time points through steps S260-S280.

[0117] Optionally, after calculating the situational awareness results of the node to be evaluated at future time points, the method further includes: processing the node to be evaluated whose risk level data is higher than a preset threshold.

[0118] Based on the situational awareness results, the risk level data corresponding to each node to be evaluated can be predicted. If the risk level data is higher than the preset threshold (e.g., greater than or equal to 1), it can be considered that the data corresponding to the current node in the system is at risk in the future. A corresponding risk warning mechanism can be set up so that developers can perform corresponding business processing to avoid some risks.

[0119] The situational awareness implementation method provided in this embodiment of the invention uses formula (1) to estimate the risk level data of the node to be evaluated at a future time point by using the corresponding calculation method according to the different functions of the node to be evaluated. This method not only considers the changes in the risk level data of the node to be evaluated itself, but also combines the changes in the risk level data of the nodes related to it, which is more in line with the actual scenario and can make the estimation results more accurate.

[0120] Example 3

[0121] Figure 3 This invention provides a structural block diagram of a situational awareness implementation device. This device can be implemented by software and / or hardware, and is generally integrated into computer equipment such as servers. It can perform situational awareness on data by executing situational awareness implementation methods to predict the risk level of the data. Figure 3 As shown, the device includes: a risk level data acquisition module 31, a correlation determination module 32, a probability distribution model establishment module 33, and a situational awareness result acquisition module 34, wherein:

[0122] The risk level data acquisition module 31 is used to take at least two nodes in the system as target nodes and acquire the risk level data corresponding to each target node.

[0123] The association relationship determination module 32 is used to determine the association relationship between the target nodes, wherein the association relationship between the target nodes includes a first association relationship and / or a second association relationship, where nodes with the first association relationship belong to different functions and there is data flow between the nodes, and nodes with the second association relationship belong to the same function;

[0124] The probability distribution model establishment module 33 is used to establish a conditional probability distribution model based on the conditional probability and the risk level data for the target nodes that have the first association relationship; and to establish a joint probability distribution model based on the joint probability distribution and the risk level data for the target nodes that have the second association relationship.

[0125] The situation awareness result acquisition module 34 is used to perform situation awareness based on the conditional probability distribution model and the joint probability distribution model, and obtain situation awareness results.

[0126] The situational awareness implementation device provided in this embodiment of the invention first identifies at least two nodes in the system as target nodes and acquires risk level data corresponding to each target node. Then, it determines the correlation between the target nodes, wherein the correlation includes a first correlation and / or a second correlation. Nodes with a first correlation belong to different functions and have data flow between them, while nodes with a second correlation belong to the same function. Next, for the target nodes with a first correlation, a conditional probability distribution model is established based on conditional probability and risk level data; for the target nodes with a second correlation, a joint probability distribution model is established based on joint probability distribution and risk level data. Finally, situational awareness is performed based on the conditional probability distribution model and the joint probability distribution model to obtain the situational awareness result. By employing the above technical solution to analyze the correlation between target nodes, different probability distribution models are established according to different correlations. The computational probability distribution reduces the algorithmic difficulty, achieving the technical effect of improving the flexibility of situational awareness modeling and reducing modeling costs.

[0127] Optionally, the probability distribution model building module 33 includes: a first dataset acquisition unit, a first data segment acquisition unit, and a conditional probability distribution model building unit, wherein:

[0128] The first dataset acquisition unit is used to acquire the first dataset corresponding to the first type of nodes that have the first association relationship in the target data nodes;

[0129] The first data segment acquisition unit is used to take the time period in which there is a data transmission flow between the first datasets as the first target time period, and divide the datasets corresponding to the first target time period using a first preset time interval to obtain multiple first data segments.

[0130] The conditional probability distribution model establishment unit is used to determine the risk level corresponding to each first data segment using a first preset rule, and to establish a conditional probability distribution model based on the risk level corresponding to each first data segment.

[0131] Optionally, the probability distribution model building module 33 further includes: a second dataset acquisition unit, a second data segment acquisition unit, and a joint probability distribution model building unit, wherein:

[0132] The second dataset acquisition unit is used to acquire the second dataset corresponding to the second type of nodes that have the second association relationship in the target data nodes;

[0133] The second data segment acquisition unit is used to take the time period in which the data in the second dataset is related as the second target time period, and divide the dataset corresponding to the second target time period using the first preset time interval to obtain multiple second data segments.

[0134] The joint probability distribution model establishment unit is used to determine the risk level corresponding to each second data segment using a second preset rule, and to establish a joint probability distribution model based on the risk level corresponding to each second data segment.

[0135] Optionally, the situational awareness result acquisition module 34 includes: an expected value prediction unit, a risk level prediction unit, and a situational awareness result calculation unit, wherein:

[0136] The expected value prediction unit is used to predict the expected value of the risk level corresponding to the node to be evaluated at a future time point based on the node to be evaluated at the current time point and the corresponding risk level, wherein the time interval between the future time point and the current time point is a first preset time interval.

[0137] The risk level prediction unit is used to predict the first risk level of the node to be evaluated at a future time point based on the conditional probability distribution model and the risk level of the first type of node corresponding to the node to be evaluated at the current time point; and to predict the second risk level of the node to be evaluated at a future time point based on the joint probability distribution model and the risk level of the second type of node corresponding to the node to be evaluated at the current time point.

[0138] The situational awareness result calculation unit is used to calculate the situational awareness result of the node to be evaluated at a future time point using a preset method based on the expected value of the risk level corresponding to the node to be evaluated, the first risk level, and the second risk level.

[0139] Optionally, the preset method is represented by the following expression:

[0140]

[0141] In the formula, a and b represent constants, and satisfy a + b = 1; risk x_newThis represents the risk level data of the node to be evaluated at a future time point; l represents the total number of nodes in the first category corresponding to the node to be evaluated; n represents the total number of nodes in the second category corresponding to the node to be evaluated; risk x-self-new This represents the expected value of the risk level corresponding to the node to be evaluated at a future point in time; risk x-diff-new This represents the risk level data of the first category of nodes corresponding to the node to be evaluated at a future time point; risk x-sam-new This represents the risk level data of the node to be evaluated and the corresponding second-category node at future time points;

[0142] The risk level data of the node to be evaluated at a future time point represents the situational awareness result.

[0143] Optionally, the situational awareness result acquisition module 34 further includes: a processing unit;

[0144] The processing unit is used to process nodes whose risk level data is higher than a preset threshold.

[0145] Optionally, the device further includes: a risk level data determination module;

[0146] The risk level data determination module is used to acquire historical data corresponding to nodes within a preset time period, and determine the risk level data corresponding to each node based on the historical data.

[0147] The situational awareness implementation apparatus provided in the embodiments of the present invention can execute the situational awareness implementation method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of executing the method.

[0148] Example 4

[0149] This invention provides a computer device that can integrate the situational awareness implementation device provided in this invention. Figure 4 This is a structural block diagram of a computer device provided in an embodiment of the present invention. The computer device 40 may include: a memory 41, a processor 42, and a computer program stored in the memory 41 and executable on the processor. When the processor 42 executes the computer program, it implements the situational awareness implementation method as described in the embodiment of the present invention.

[0150] The computer device provided in the embodiments of the present invention can execute the situational awareness implementation method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of executing the method.

[0151] Example 5

[0152] This invention also provides a storage medium containing computer-executable instructions, which, when executed by a computer processor, are used for a method of implementing situational awareness. The method includes:

[0153] Use at least two nodes in the system as target nodes and obtain the risk level data corresponding to each target node.

[0154] Determine the association relationship between the target nodes, wherein the association relationship between the target nodes includes a first association relationship and / or a second association relationship, where nodes with the first association relationship belong to different functions and there is data flow between the nodes, and nodes with the second association relationship belong to the same function;

[0155] For the target nodes that have the first association relationship, a conditional probability distribution model is established based on the conditional probability and the risk level data; for the target nodes that have the second association relationship, a joint probability distribution model is established based on the joint probability distribution and the risk level data.

[0156] Situational awareness is performed based on the conditional probability distribution model and the joint probability distribution model to obtain situational awareness results.

[0157] Storage medium – any type of memory device or storage device. The term “storage medium” is intended to include: mounting media, such as CD-ROM, floppy disk, or magnetic tape devices; computer system memory or random access memory, such as DRAM, DDRRAM, SRAM, EDORAM, Rambus RAM, etc.; non-volatile memory, such as flash memory, magnetic media (e.g., hard disk or optical storage); registers or other similar types of memory elements, etc. Storage medium may also include other types of memory or combinations thereof. Furthermore, storage medium may reside in a first computer system in which the program is executed, or it may reside in a different second computer system connected to the first computer system via a network (such as the Internet). The second computer system can provide program instructions to the first computer for execution. The term “storage medium” can include two or more storage media that may reside in different locations (e.g., in different computer systems connected via a network). Storage medium may store program instructions (e.g., specifically implemented as a computer program) executable by one or more processors.

[0158] Of course, the computer-executable instructions provided in the embodiments of the present invention are not limited to the situational awareness implementation operations described above, but can also execute related operations in the situational awareness implementation methods provided in any embodiment of the present invention.

[0159] The situational awareness implementation apparatus, device, and storage medium provided in the above embodiments can execute the situational awareness implementation method provided in any embodiment of the present invention, and have the corresponding functional modules and beneficial effects of executing the method. Technical details not described in detail in the above embodiments can be found in the situational awareness implementation method provided in any embodiment of the present invention.

[0160] Note that the above description is merely a preferred embodiment of the present invention and the technical principles employed. Those skilled in the art will understand that the present invention is not limited to the specific embodiments described herein, and various obvious changes, readjustments, and substitutions can be made without departing from the scope of protection of the present invention. Therefore, although the present invention has been described in detail through the above embodiments, the present invention is not limited to the above embodiments, and may include many other equivalent embodiments without departing from the concept of the present invention, the scope of which is determined by the scope of the appended claims.

Claims

1. A method for implementing situational awareness, characterized in that, include: Use at least two nodes in the system as target nodes and obtain the risk level data corresponding to each target node. Determine the association relationship between the target nodes, wherein the association relationship between the target nodes includes a first association relationship and / or a second association relationship, where nodes with the first association relationship belong to different functions and there is data flow between the nodes, and nodes with the second association relationship belong to the same function; For the target nodes that have the first association relationship, a conditional probability distribution model is established based on the conditional probability and the risk level data; for the target nodes that have the second association relationship, a joint probability distribution model is established based on the joint probability distribution and the risk level data. Situational awareness is performed based on the conditional probability distribution model and the joint probability distribution model to obtain situational awareness results; The step of performing situational awareness based on the conditional probability distribution model and the joint probability distribution model to obtain situational awareness results includes: Based on the node to be evaluated at the current time point and the corresponding risk level, predict the expected value of the risk level corresponding to the node to be evaluated at a future time point, wherein the time interval between the future time point and the current time point is a first preset time interval; Based on the conditional probability distribution model and the risk level of the first type of node corresponding to the node to be evaluated at the current time, a first risk level of the node to be evaluated at a future time is predicted. The first risk level is determined by the risk level of the node to be evaluated at the predicted future time based on the risk level of nodes that have data flow with the node to be evaluated and belong to different functions within the time range from the current time to the future time. Based on the joint probability distribution model and the risk level of the second type of node corresponding to the node to be evaluated at the current time, a second risk level of the node to be evaluated at a future time is predicted. The second risk level is determined by the risk level of nodes that have data flow with the node to be evaluated and belong to the same functions within the time range from the current time to the future time. Using a preset method, the situational awareness result of the node to be evaluated at a future time point is calculated based on the expected value of the risk level corresponding to the node to be evaluated, the first risk level, and the second risk level. The preset method is represented by the following expression: In the formula, a and b Denotes a constant, and satisfies a+b =1; This indicates the risk level data of the node to be evaluated at a future point in time; l This represents the total number of nodes corresponding to the first type of nodes to be evaluated; n This represents the total number of nodes of the second type corresponding to the node to be evaluated; This represents the expected value of the risk level corresponding to the node to be evaluated at a future time point; This represents the risk level data of the first category node corresponding to the node to be evaluated at a future time point; This represents the risk level data of the node to be evaluated and the corresponding second-category node at future time points; The risk level data of the node to be evaluated at a future time point represents the situational awareness result.

2. The method according to claim 1, characterized in that, For the target nodes that have the first association relationship, a conditional probability distribution model is established based on the conditional probability and the risk level data, including: For the first type of nodes in the target data nodes that have the first association relationship, obtain the first dataset corresponding to each of the first type of nodes; The time period in which there is a data transmission flow between the first datasets is taken as the first target time period. The datasets corresponding to the first target time period are divided using a first preset time interval to obtain multiple first data segments. The risk level corresponding to each first data segment is determined using a first preset rule, and a conditional probability distribution model is established based on the risk level corresponding to each first data segment.

3. The method according to claim 1, characterized in that, For the nodes among the target nodes that have the second association relationship, a joint probability distribution model is established based on the joint probability distribution and the risk level data, including: For the second type of nodes in the target data nodes that have the second association relationship, obtain the second datasets corresponding to the second type of nodes respectively; The time period in which the data in the second datasets are correlated is taken as the second target time period. The dataset corresponding to the second target time period is divided using the first preset time interval to obtain multiple second data segments. The risk level corresponding to each second data segment is determined using a second preset rule, and a joint probability distribution model is established based on the risk level corresponding to each second data segment.

4. The method according to claim 1, characterized in that, After calculating the situational awareness results of the node to be evaluated at future time points, the process also includes: Process nodes whose risk level data exceeds a preset threshold.

5. The method according to claim 1, characterized in that, Before obtaining the risk level data corresponding to each target node, with at least two nodes in the system as target nodes, the process also includes: Obtain historical data corresponding to nodes within a preset time period, and determine the risk level data corresponding to each node based on the historical data.

6. A situational awareness implementation device, characterized in that, include: The risk level data acquisition module is used to select at least two nodes in the system as target nodes and obtain the risk level data corresponding to each target node. The association relationship determination module is used to determine the association relationship between the target nodes, wherein the association relationship between the target nodes includes a first association relationship and / or a second association relationship, where nodes with the first association relationship belong to different functions and there is data flow between the nodes, and nodes with the second association relationship belong to the same function; The probability distribution model building module is used to build a conditional probability distribution model based on the conditional probability and the risk level data for the target nodes that have the first association relationship; and to build a joint probability distribution model based on the joint probability distribution and the risk level data for the target nodes that have the second association relationship. The situational awareness result acquisition module is used to perform situational awareness based on the conditional probability distribution model and the joint probability distribution model, and obtain situational awareness results. The situational awareness result acquisition module is specifically used to predict the expected value of the risk level corresponding to the node to be evaluated at a future time point based on the node to be evaluated at the current time point and the corresponding risk level, wherein the time interval between the future time point and the current time point is a first preset time interval. Based on the conditional probability distribution model and the risk level of the first type of node corresponding to the node to be evaluated at the current time, a first risk level of the node to be evaluated at a future time is predicted. The first risk level is determined by the risk level of the node to be evaluated at the predicted future time based on the risk level of nodes that have data flow with the node to be evaluated and belong to different functions within the time range from the current time to the future time. Based on the joint probability distribution model and the risk level of the second type of node corresponding to the node to be evaluated at the current time, a second risk level of the node to be evaluated at a future time is predicted. The second risk level is determined by the risk level of nodes that have data flow with the node to be evaluated and belong to the same functions within the time range from the current time to the future time. Using a preset method, the situational awareness result of the node to be evaluated at a future time point is calculated based on the expected value of the risk level corresponding to the node to be evaluated, the first risk level, and the second risk level. The preset method is represented by the following expression: In the formula, a and b Denotes a constant, and satisfies a+b =1; This indicates the risk level data of the node to be evaluated at a future point in time; l This represents the total number of nodes corresponding to the first type of nodes to be evaluated; n This represents the total number of nodes of the second type corresponding to the node to be evaluated; This represents the expected value of the risk level corresponding to the node to be evaluated at a future time point; This represents the risk level data of the first category node corresponding to the node to be evaluated at a future time point; This represents the risk level data of the node to be evaluated and the corresponding second-category node at future time points; The risk level data of the node to be evaluated at a future time point represents the situational awareness result.

7. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method as described in any one of claims 1-5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1-5.

Images