A method, apparatus, electronic device, and storage medium for analyzing the operating status of terminal equipment.

Abstract

This invention discloses a method, apparatus, electronic device, and storage medium for analyzing the operating status of terminal devices, relating to the field of terminal security technology. The method includes: assigning corresponding clustering seed points based on object labels of acquired terminal device operating data; calculating the cluster centers to which the seed points belong using a clustering algorithm; performing random forest fitting on the obtained cluster centers to which the seed points belong to obtain unbiased prediction values ​​for the cluster centers; generating a Gaussian distribution map of the seed points based on the unbiased prediction values ​​and their corresponding seed points; and determining the operating status of the terminal device based on the Gaussian distribution map. This eliminates the need for categorizing and reporting terminal device operating data, solving the problem of redundant reported data and reducing the amount of repetitive server analysis and computation.

Description

Technical Field

[0001] This invention relates to the field of terminal security technology, and in particular to a method, apparatus, electronic device, and storage medium for analyzing the operating status of terminal devices. Background Technology

[0002] Firewalls, acting as a relatively isolated protective barrier between a computer network and its internal and external networks, are crucial for protecting the security of user data and information. One of the main functions of a firewall is to record and monitor the various operations of terminal devices, such as computers, and the network during operation, creating firewall logs to ensure the security of terminal devices and network operations.

[0003] Currently, the operating status of a computer, such as the status of hardware and software usage, system operation status, and network traffic usage, is generally determined by firewall log traffic detection and the various types of operating data reported by the control software installed on the terminal device, such as data on the CPU, hard drive, network card, etc. The security system (essentially a server) creates corresponding behavior monitoring rules for each sub-category and analyzes the reported categorized data to determine the operating status of the terminal device.

[0004] In the process of realizing this invention, the inventors discovered that the above-mentioned existing solutions require reporting operational data in categories each time, and creating monitoring rules based on the operational data of each sub-category, and analyzing and calculating them separately. Since some sub-category operational data can create the same monitoring rules based on commonalities, the above solutions inevitably have the problem of redundant reported data, increasing the amount of repeated analysis and calculation on the server. Summary of the Invention

[0005] In view of this, embodiments of the present invention provide a method, apparatus, electronic device and storage medium for analyzing the operating status of terminal devices, which eliminates the need to classify and report the operating data of terminal devices, solves the problem of redundant reported data, and reduces the amount of repetitive analysis and calculation on the server.

[0006] In a first aspect, the terminal device operation status analysis method provided by the embodiments of the present invention includes the following steps: acquiring the operation data of the terminal device and determining the object label of the operation data of the terminal device; assigning a corresponding clustering seed point according to the object label of the operation data of the terminal device; calculating the cluster center to which the clustering seed point belongs based on a clustering algorithm; performing random forest fitting on the obtained cluster center to which the clustering seed point belongs to obtain the unbiased prediction value of the cluster center to which the clustering seed point belongs; generating a Gaussian distribution map of the clustering seed point according to the obtained unbiased prediction value of the cluster center to which the clustering seed point belongs and its corresponding clustering seed point; and determining the operation status of the terminal device according to the Gaussian distribution map of the clustering seed point.

[0007] In conjunction with the first aspect, in a first embodiment of the first aspect, determining the object label of the terminal device's operating data includes: extracting feature values ​​of the operating data; and determining the object label of the operating data based on the feature values ​​of the operating data.

[0008] In conjunction with the first aspect, in the second implementation of the first aspect, the operational data includes one or three of the following: terminal device hardware and software data, system operation behavior data, and network traffic log data, with each type of data including multiple data objects; the object label is an identity label used to identify the subject to which the data object points; the step of assigning corresponding clustering seed points based on the object labels of the terminal device's operational data includes: determining preliminary clustering categories and their number using the leaf nodes of a decision tree structure without branch reduction based on the object labels of the terminal device's operational data; the preliminary clustering category is the clustering seed point.

[0009] In conjunction with the first aspect, in the third embodiment of the first aspect, the step of calculating the cluster center to which the cluster seed point belongs based on the clustering algorithm includes: calculating the distance from each cluster seed point to each cluster center; comparing the distance from each cluster seed point to each cluster center in turn; determining the cluster center closest to each cluster seed point as the cluster center of the cluster to which the cluster seed point belongs; and recalculating and determining the cluster center of each cluster for all cluster seed points in each cluster.

[0010] In conjunction with the first aspect and / or the first and second embodiments of the first aspect, in the fourth embodiment of the first aspect, after determining the cluster center closest to each cluster seed point as the cluster center to which the cluster seed point belongs, the method further includes: dividing all cluster seed points into an equal number of clusters according to the number of cluster seed points determined by the decision tree; calculating the distance between clusters; comparing the obtained distance between clusters with a preset screening threshold; and removing clusters whose distance between clusters is greater than the preset screening threshold.

[0011] In conjunction with the first aspect and / or any one of the first to fourth embodiments of the first aspect, in the fifth embodiment of the first aspect, generating the Gaussian distribution map of the cluster seed points based on the unbiased prediction values ​​of the cluster centers to which the cluster seed points belong and their corresponding cluster seed points includes: calculating the Gaussian distribution word frequency distribution area of ​​the cluster seed points and the corresponding distribution area landing probability according to the Gaussian distribution formula based on the unbiased prediction values ​​of the cluster centers to which the cluster seed points belong and their corresponding cluster seed points; and generating the Gaussian distribution map of the cluster seed points based on the obtained Gaussian distribution word frequency distribution area of ​​the cluster seed points and the corresponding distribution area landing probability.

[0012] In conjunction with the first aspect and the first to fifth embodiments of the first aspect, in the sixth embodiment of the first aspect, the operating data includes: abnormal operating data; after calculating the Gaussian distribution word frequency distribution area and the corresponding distribution area landing probability of the cluster seed point according to the Gaussian distribution formula, the method further includes: generating abnormal status classification alarm data of the terminal device according to the obtained Gaussian distribution word frequency distribution area and the corresponding distribution area landing probability of the cluster seed point.

[0013] Secondly, embodiments of the present invention also provide a terminal device operation status analysis apparatus, the apparatus comprising: an acquisition program module for acquiring operation data of the terminal device and determining object labels of the operation data of the terminal device; a setting program module for assigning corresponding clustering seed points according to the object labels of the operation data of the terminal device; a clustering program module for calculating the cluster centers to which the clustering seed points belong based on a clustering algorithm; a fitting program module for performing random forest fitting on the obtained cluster centers to which the clustering seed points belong to obtain unbiased prediction values ​​of the cluster centers to which the clustering seed points belong; a generation program module for generating a Gaussian distribution map of the clustering seed points according to the obtained unbiased prediction values ​​of the cluster centers to which the clustering seed points belong and their corresponding clustering seed points; and a determination program module for determining the operation status of the terminal device according to the Gaussian distribution map of the clustering seed points.

[0014] Thirdly, embodiments of the present invention provide an electronic device, the electronic device comprising: a housing, a processor, a memory, a circuit board, and a power supply circuit, wherein the circuit board is disposed within a space enclosed by the housing, and the processor and the memory are disposed on the circuit board; the power supply circuit is used to supply power to various circuits or devices of the electronic device; the memory is used to store executable program code; the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, for executing the method described in any embodiment of the first aspect.

[0015] Fourthly, embodiments of the present invention provide a computer-readable storage medium storing one or more programs, which can be executed by one or more processors to implement the method described in any embodiment of the first aspect.

[0016] The terminal device operation status analysis method, apparatus, electronic device, and storage medium provided in this invention, after acquiring the operation data of the terminal device, can automatically classify the reported sub-category operation data based on the determined object labels of the terminal device operation data and a clustering algorithm, without the need for data classification and reporting, and therefore without the need to create monitoring rules corresponding to each sub-category of operation data. Furthermore, by performing random forest fitting on the cluster centers to which the obtained cluster seed points belong, unbiased prediction values ​​of the cluster centers to which the cluster seed points belong are obtained. Based on the obtained cluster centers (major categories) to which the cluster seed points (sub-category operation data) belong and the unbiased prediction values, a Gaussian distribution map of the cluster seed points is generated. Based on the Gaussian distribution map of the cluster seed points, the distribution of each sub-category of operation data and its probability in the major category can be intuitively determined. Only a few monitoring rules need to be created based on the major category, and the operation status of the terminal device can be quantitatively analyzed based on the distribution of each sub-category of operation data and its probability in the major category. This solves the problem of redundant reported data and reduces the amount of repetitive analysis and computation on the server. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart illustrating an embodiment of the terminal device operation status analysis method of the present invention;

[0019] Figure 2 This is a schematic diagram of a decision tree structure without pruning leaf nodes used in the terminal device operation status analysis method of the present invention to determine the preliminary cluster categories and their number.

[0020] Figure 3 This is a flowchart illustrating an embodiment of the terminal device operation status analysis method of the present invention;

[0021] Figure 4 This is a Gaussian distribution diagram of network traffic data categories obtained by the terminal device operation status analysis method of the present invention;

[0022] Figure 5 This is an architectural diagram of an embodiment of the terminal device operation status analysis device of the present invention;

[0023] Figure 6 This is an architectural diagram of another embodiment of the terminal device operation status analysis device of the present invention;

[0024] Figure 7 This is an architectural diagram of another embodiment of the terminal device operation status analysis device of the present invention;

[0025] Figure 8 This is a schematic diagram of the structure of an embodiment of the electronic device of the present invention. Detailed Implementation

[0026] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings.

[0027] It should be understood that the described embodiments are merely some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

[0028] Figure 1 This is a flowchart illustrating an embodiment of the terminal device operation status analysis method of the present invention. (See attached diagram.) Figure 1 As shown, the terminal device operation status analysis method provided in this embodiment of the invention can be applied to terminal device operation status monitoring scenarios such as computers and mobile phones. It should be noted that the method can be embedded in a manufactured product in the form of software, and the method flow of this application can be reproduced when the user uses the product.

[0029] For example, the terminal device operation status analysis method provided in this embodiment is installed on electronic devices such as computers and mobile phones in the form of application software. When a user triggers the product to run on a computer or mobile phone, the current operation status of the electronic device is automatically analyzed based on the operation data reported by the computer or other electronic device (generally reported in the form of logs). The method previously embedded in the electronic product is mechanically reproduced. The reported operation data is processed and analyzed according to the method steps to determine whether there is any abnormality in the terminal device operation status, so as to ensure the reliability and security of the terminal device operation.

[0030] See Figure 1 The terminal device operation status analysis method of this embodiment may include the following steps:

[0031] 110. Obtain the operating data of the terminal device and determine the object tag of the operating data of the terminal device.

[0032] In this embodiment, the type of terminal device may include, but is not limited to: personal computer terminal, node server, business service system and portable device, including laptop computer, tablet computer and smartphone.

[0033] The operational data refers to unclassified data generated during the operation of the terminal device, including: terminal device hardware and software data (i.e. Figure 2Terminal node items), system operation behavior data (i.e. Figure 2 System node items) and network traffic log data (i.e. Figure 2 The data can be categorized into one or three types within a firewall node item, with each type including various data objects; for example, CPU data, GPU data, hard disk data, network card data, firewall network traffic logs, operating system vulnerability logs, and operation logs.

[0034] The operational data can be obtained either by the terminal device collecting the data itself and then actively reporting it, or by the server issuing a request command and the terminal device receiving the data in return.

[0035] like Figure 2 The bottom-level leaf nodes in the decision tree classification shown do not completely list some object label categories. The object labels are identity labels used to identify the subject to which the data object points; for example, CPU, hard disk, network card, registry, intranet, extranet, login, operating system vulnerability log, operation log, etc.

[0036] In this embodiment, as an optional embodiment, determining the object label of the terminal device's operating data includes: extracting the feature values ​​of the operating data; and determining the object label of the operating data based on the feature values ​​of the operating data.

[0037] Among them, the feature value refers to the character contained in the running data that can be used to identify or confirm the subject to which the current data object points; for example, if the running data contains characters such as Hertz, frequency, and temperature, then the object label of the current data can be determined to be CPU.

[0038] For example, if characters such as IP, port, flow direction, and protocol appear in the running data, it can be determined that the current data object label is inbound or outbound traffic.

[0039] This embodiment extracts the feature values ​​of the running data and determines the object label of the running data based on the feature values ​​of the running data. Compared with the traditional manual labeling method, it can effectively improve the efficiency of labeling.

[0040] 120. Provide corresponding clustering seed points based on the object labels of the terminal device's operational data. Each object label can be used as a sample, labeled X; based on the category of the object label, use the object label as the corresponding clustering seed point. For example, object labels may be: CPU, GPU, hard disk, network card, firewall network traffic logs, operating system vulnerability logs, operation logs, etc., and these may be used as given clustering seed points, labeled as: A = A1, A2, ... As.

[0041] Since clustering algorithms require a given clustering seed point, i.e., the initial number of data cluster categories, as an optional embodiment, the step of giving the corresponding clustering seed point based on the object labels of the terminal device's operating data includes: determining the initial cluster categories and their number for the clustering algorithm using the leaf nodes of a decision tree structure without branch reduction based on the object labels of the terminal device's operating data; the initial cluster categories are the clustering seed points.

[0042] Each leaf node provides a clustering seed point. In this embodiment, based on the decision tree structure, seed points with high dimensionality and multiple classes are provided as much as possible to achieve the purpose of creating monitoring rules by clustering the data of each subclass into major classes.

[0043] Understandably, to simplify decision tree models and avoid overfitting, pruning is often performed on the decision tree structure. However, this can lead to an increase in the loss function and prediction error. In this embodiment, by using unpruned leaf nodes in the decision tree structure to provide initial cluster categories and numbers for subsequent clustering algorithms, the problem of increased loss function caused by deleting leaf nodes can be avoided to some extent. This provides subsequent clustering algorithms with initial cluster categories and numbers with smaller errors.

[0044] 130. The cluster center to which the cluster seed point belongs is calculated based on the clustering algorithm.

[0045] The clustering algorithm can be the K-Means clustering algorithm.

[0046] Specifically, the step 130, which calculates the cluster center to which the cluster seed point belongs based on the clustering algorithm, includes: 131, calculating the distance from each cluster seed point to each cluster center; 132, comparing the distance from each cluster seed point to each cluster center in turn; 133, determining the cluster center closest to each cluster seed point as the cluster center of the cluster to which the cluster seed point belongs; and 134, recalculating and determining the cluster center of each cluster for all cluster seed points in each cluster.

[0047] In step 131, the Euclidean distance from each cluster seed point to each cluster center can be calculated according to the Euclidean distance formula. The Euclidean distance calculation formula is existing technology, and it will not be described in detail here in order to highlight the innovative point of this invention.

[0048] In step 134, according to the formula Recalculate and determine the cluster centers of this cluster; where x is the cluster seed point parameter and cs is the cluster center parameter from step 133. denoted as the number of cluster center parameters, and kj as the redefined cluster center for each category.

[0049] To eliminate interfering data and reduce computational load, in some embodiments, after determining the cluster center closest to each cluster seed point as the cluster center to which the seed point belongs, the method further includes: dividing all cluster seed points into an equal number of clusters based on the number of cluster seed points determined by the decision tree; calculating the distance between clusters; comparing the obtained distance between clusters with a preset screening threshold; and removing clusters whose distance between clusters is greater than the preset screening threshold. In this way, by using the K-Means clustering algorithm to obtain the cluster center closest to the seed point, dividing the cluster seed points into an equal number of clusters according to the number of cluster seed points provided by the decision tree, maintaining the distance between clusters, and removing interfering data with large inter-cluster distances, the subsequent computational load can be reduced.

[0050] like Figure 3 As shown, exemplarily, according to Figure 2 The provided runtime data clustering seed parameters are used to calculate the cluster distance using K-Means, outputting the cluster center parameters. Data that is too far away is discarded, meaning that runtime status alarm data, such as HOSTS and internal jump categories, are not needed, thereby reducing the amount of subsequent calculations.

[0051] Understandably, some solutions create a large number of detailed abnormal behavior monitoring rules for each sub-category of operational data (usually in log form), resulting in a large number of monitoring rules being created. For example, detailed behavior monitoring rules need to be made for different sub-categories of data, as well as monitoring rules for equipment assets (including hardware and software assets), etc., and there is a lot of redundancy in related rules, which increases the amount of repetitive calculations.

[0052] In this embodiment, a decision tree structure is used to provide multiple clustering seed points for unclassified data, generating high-dimensional data that requires different monitoring rules. Then, K-Means clustering is used to calculate the distance between clusters and divide them into major categories, thus achieving the goal of creating the same monitoring rules for seed points in the same category. This realizes the creation of monitoring rules with low classification dimensions, solving the problem of cumbersome task configuration and redundant reported data in creating a large number of detailed abnormal behavior monitoring rules for each sub-category of running data, and reducing the amount of repetitive calculations.

[0053] 140. Perform random forest fitting on the cluster centers to which the obtained cluster seed points belong to obtain unbiased prediction values ​​for the cluster centers to which the obtained cluster seed points belong.

[0054] Specifically, step 140 includes: performing random forest fitting on the cluster seed points in the clusters (majors) to which the cluster centers to which the obtained cluster seed points belong, wherein the random forest fitting formula is: I(X=x i )=-log2 p(x i In the formula: X is the clustering seed point parameter, xi Let represent the parameter of the i-th cluster seed point; P is the total number of cluster seed point parameters, and I is the unbiased prediction value.

[0055] In step 130, the cluster centers obtained using the clustering algorithm are inherently biased, meaning they may include seed points that do not belong to a particular cluster. Therefore, to address this bias in the results obtained by the K-means clustering algorithm, this embodiment uses Random Forest (RF, whose basic building block is the decision tree) to fit and correct the results obtained in step 130. This reduces the biased classification bias and yields the true cluster centers to which the seed points within each cluster belong—the unbiased predicted values. After the Random Forest algorithm corrects the bias, accurate cluster centers are obtained, thus determining the accurate classification category and improving the accuracy of the predicted classification.

[0056] It is understandable that each cluster has a cluster center. By dividing all the data into multiple categories (clusters), multiple true cluster centers corresponding to multiple categories will be obtained, which are unbiased predicted values, thus dividing all the data into the corresponding classes.

[0057] 150. Based on the unbiased predicted values ​​of the cluster centers to which the cluster seed points belong and their corresponding cluster seed points, generate a Gaussian distribution map of the cluster seed points.

[0058] In some embodiments, generating a Gaussian distribution map of the cluster seed points based on the unbiased predicted values ​​of the cluster centers to which the cluster seed points belong and their corresponding cluster seed points includes: calculating the Gaussian distribution word frequency distribution area and the corresponding distribution area landing probability of the cluster seed points according to the Gaussian distribution formula based on the unbiased predicted values ​​of the cluster centers to which the cluster seed points belong and their corresponding cluster seed points; and generating a Gaussian distribution map of the cluster seed points based on the obtained Gaussian distribution word frequency distribution area and the corresponding distribution area landing probability of the cluster seed points.

[0059] The Gaussian distribution formula is:

[0060] Where, n i Let be the i-th cluster seed point, where i is an integer from 1 to k, k is the unbiased predicted value (a dimensionless constant), and n is the sample size (i.e., the total number) of the cluster seed points. i =n indicates stratified sampling from the sample size. The "=" sign can be understood as assignment; for example, when calculating the probability of a second cluster seed point, n... i =n2; P refers to the word frequency distribution area and the probability of the landing point, and Otherwise refers to other cases besides the above conditions.

[0061] The Gaussian frequency distribution region refers to a word, which in the computer field essentially refers to the percentage of frequency of a character. This character is usually a feature value or characteristic character shared by the same subclass of running data. In the specific scenario of this article, it refers to the percentage of the frequency of the feature value in the cluster seed point relative to the cluster center (major class) to which the cluster seed point belongs. For example, there are two sets of running data, where the cluster seed points are the login and logout tag categories. According to the analysis method steps provided in this embodiment, the cluster seed points of the login and logout tags are classified into the network traffic category. Both login and logout contain the feature value IP character. Therefore, the percentage of login and logout in the major class of network traffic is determined based on the number of times the IP character appears, thus determining the Gaussian frequency distribution region of the cluster seed point.

[0062] 160. Determine the operating status of the terminal device based on the Gaussian distribution map of the clustering seed points.

[0063] Figure 4 This illustration shows a Gaussian distribution diagram obtained by analyzing network traffic categories in operational data according to an embodiment of the present invention, such as... Figure 4 As shown in the figure, the distribution (classification) of data in each subcategory of network traffic in terminal devices and the probability of each subcategory in the main category can be seen intuitively.

[0064] When the operational data is the reported firewall log, the data in the firewall log is generally used to indicate abnormal network traffic usage of terminal devices, such as computers. Based on the classification and prediction of the data in the firewall log, the resulting Gaussian distribution map can intuitively characterize whether there is an abnormality in the computer's operating status, and can also output alarms to alert the computer's operating status.

[0065] Therefore, in some embodiments, the operating data includes: abnormal operating data; after calculating the Gaussian distribution word frequency distribution area and the corresponding distribution area landing probability of the cluster seed point according to the Gaussian distribution formula, the method further includes: generating abnormal status classification alarm data of the terminal device according to the obtained Gaussian distribution word frequency distribution area and the corresponding distribution area landing probability of the cluster seed point.

[0066] The alarm data can be output and displayed in the form of the aforementioned Gaussian distribution chart, so that users can intuitively understand the abnormal operating status of various assets on the terminal device.

[0067] In this embodiment, since the acquired operational data may contain cross-asset data, for example, a reported abnormal operational data includes login, logout, and CPU, a Gaussian distribution plot is obtained according to the method steps provided in this embodiment. From the Gaussian distribution plot, it can be seen that the probability of login and logout in the system category is 67% (the highest point of abnormality), and hardware is 33% (the highest point of abnormality in this category). Based on this, it can be analyzed that the current computer has a system risk of 67% and a hardware risk of 33%, which realizes the cross-comprehensive verification of abnormal asset data and obtains the abnormal probability, realizing the quantitative assessment of the abnormal operating status of terminal devices.

[0068] As described above, the terminal device operation status analysis method provided in this embodiment of the invention, after acquiring the operation data of the terminal device, can automatically classify the reported sub-category operation data based on the determined object labels of the terminal device's operation data using a clustering algorithm, eliminating the need for data classification and reporting, and consequently eliminating the need to create monitoring rules corresponding to each sub-category of operation data. Furthermore, by performing random forest fitting on the cluster seed points and then performing random forest fitting on the cluster centers to which the obtained cluster seed points belong, unbiased prediction values ​​for the cluster centers to which the cluster seed points belong are obtained. Based on the obtained cluster centers (major categories) to which the cluster seed points belong and their unbiased prediction values, a Gaussian distribution map of the cluster seed points is generated. Based on the Gaussian distribution map of the cluster seed points, the distribution of each sub-category of operation data and its probability within the major category can be intuitively determined. Only a few monitoring rules need to be created based on the major category, and the operation status of the terminal device can be quantitatively analyzed based on the distribution of each sub-category of operation data and its probability within the major category. This solves the problem of redundant reported data, thereby reducing the amount of repetitive analysis and computation on the server. Furthermore, the present invention can also predict and alarm various operating states of terminal devices.

[0069] Example 2

[0070] Figure 5 This is a schematic diagram of an embodiment of the terminal device operation status analysis device of the present invention. (See attached diagram.) Figure 4 As shown, the apparatus of this embodiment includes:

[0071] The acquisition module 210 is used to acquire the operating data of the terminal device and determine the object tag of the operating data of the terminal device.

[0072] The program module 220 is configured to provide corresponding clustering seed points based on the object labels of the operating data of the terminal device.

[0073] Clustering module 230 calculates the cluster center to which the clustering seed point belongs based on a clustering algorithm;

[0074] The fitting program module 240 is used to perform random forest fitting on the cluster centers to which the obtained cluster seed points belong, so as to obtain the unbiased prediction values ​​of the cluster centers to which the cluster seed points belong.

[0075] The generation module 250 is used to generate a Gaussian distribution map of the cluster seed points based on the unbiased prediction values ​​of the cluster centers to which the cluster seed points belong and their corresponding cluster seed points.

[0076] The program module 260 is used to determine the operating status of the terminal device based on the Gaussian distribution map of the clustering seed points.

[0077] The apparatus of this embodiment can be used to perform Figure 1 The technical solutions of the method embodiments shown are similar in principle and in effect, and will not be described again here.

[0078] See Figure 6 As shown, in some embodiments, the acquisition program module 210 includes: an extraction program unit 211, used to extract feature values ​​of the running data; and a tag determination program unit 212, used to determine object tags of the running data based on the feature values ​​of the running data.

[0079] In some other embodiments, the operational data includes one or three of the following: terminal device hardware and software data, system operation behavior data, and network traffic log data, with each type of data including multiple data objects; the object tag is an identity tag used to identify the subject to which the data object points.

[0080] The setting program module 220 is specifically used to determine the preliminary clustering categories and their number for the clustering algorithm based on the object labels of the terminal device's operating data and using the leaf nodes of the decision tree structure without branch reduction; the preliminary clustering category is the clustering seed point.

[0081] In some embodiments, the clustering program module 230 includes: a first calculation program unit for calculating the distance from each cluster seed point to each cluster center; a comparison program unit for sequentially comparing the distance from each cluster seed point to each cluster center; a cluster determination program unit for determining the cluster center closest to each cluster seed point as the cluster center of the cluster to which the cluster seed point belongs; and a second calculation program unit for recalculating and determining the cluster center of each cluster for all cluster seed points in each cluster.

[0082] In some other embodiments, the clustering program module 230 further includes: a partitioning program unit, used to partition all clustering seed points into equal number of clusters based on the number of clustering seed points determined by the decision tree after determining the cluster center closest to each clustering seed point as the cluster center to which the clustering seed point belongs; a distance calculation program unit, used to calculate the distance between clusters; a comparison program unit, used to compare the obtained distance between clusters with a preset screening threshold; and a screening program unit, used to remove clusters whose distance between clusters is greater than the preset screening threshold.

[0083] See Figure 7 As shown, in some embodiments, the generation program module 250 includes: a third calculation program unit 251, used to calculate the Gaussian distribution word frequency distribution area and the corresponding distribution area landing probability of the cluster seed point based on the unbiased predicted value of the cluster center to which the cluster seed point belongs and the corresponding cluster seed point, according to the Gaussian distribution formula; and a generation program unit 252, used to generate the Gaussian distribution map of the cluster seed point based on the obtained Gaussian distribution word frequency distribution area and the corresponding distribution area landing probability of the cluster seed point.

[0084] In some embodiments, the runtime data includes: abnormal runtime data;

[0085] The generation program unit 260 is further configured to generate abnormal status classification alarm data of the terminal device based on the Gaussian distribution word frequency distribution area of ​​the obtained clustering seed points and the corresponding distribution area landing probability.

[0086] The device in this embodiment is similar in principle and technical effect to the corresponding method embodiment described above. For details not described in detail, please refer to each other.

[0087] Figure 8 This is a schematic diagram of the structure of an embodiment of the electronic device of the present invention. Based on the method provided in Embodiment 1 and the device provided in Embodiment 2, the present invention also provides an electronic device, such as... Figure 8 As shown, the process of any of the embodiments described in Embodiment 1 of the present invention can be implemented. The electronic device may include: a housing 41, a processor 42, a memory 43, a circuit board 44, and a power supply circuit 45. The circuit board 44 is disposed inside the space enclosed by the housing 41, and the processor 42 and the memory 43 are disposed on the circuit board 44. The power supply circuit 45 is used to supply power to the various circuits or devices of the electronic device. The memory 43 is used to store executable program code. The processor 42 runs the program corresponding to the executable program code by reading the executable program code stored in the memory 43, and is used to execute the terminal device operation status analysis method described in any of the foregoing embodiments.

[0088] For details on the specific execution process of the above steps by the processor 42 and the steps further executed by the processor 42 by running executable program code, please refer to the description of Embodiment 1 of the present invention, which will not be repeated here.

[0089] This electronic device exists in various forms, including but not limited to:

[0090] (1) Mobile communication devices: These devices are characterized by their mobile communication capabilities and primarily aim to provide voice and data communication. These terminals include: smartphones (e.g., iPhones), multimedia phones, feature phones, and low-end phones, etc.

[0091] (2) Ultra-mobile personal computer devices: These devices fall under the category of personal computers, possessing computing and processing capabilities, and generally also have mobile internet access features. These terminals include PDAs, MIDs, and UMPCs, such as the iPad.

[0092] (3) Portable entertainment devices: These devices can display and play multimedia content. This category includes: audio and video players (such as iPods), handheld game consoles, e-books, as well as smart toys and portable car navigation devices.

[0093] (4) Server: A device that provides computing services. The components of a server include a processor, hard disk, memory, system bus, etc. Servers are similar to general computer architectures, but because they need to provide highly reliable services, they have higher requirements in terms of processing power, stability, reliability, security, scalability, and manageability.

[0094] (5) Other electronic devices with data interaction functions.

[0095] Embodiments of the present invention also provide a computer-readable storage medium, characterized in that the computer-readable storage medium stores one or more programs, which can be executed by one or more processors to implement the terminal device operation status analysis method described in any of the preceding embodiments.

[0096] In summary, the terminal device operation status analysis method and apparatus provided in this embodiment of the invention do not require the classification and reporting of various operation data of the terminal device by network traffic, terminal detection equipment, etc. It can automatically classify and detect logs that record various operation data, and can realize data classification alarm output of terminal device and operation status. Furthermore, by automatically dividing various subcategories of operation data into major categories, only monitoring rules need to be created for the major categories. Compared with the traditional method of creating detailed monitoring rules for subcategories of operation data, the dimensionality of rule creation is reduced, which can reduce or even avoid the amount of repeated analysis and calculation.

[0097] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0098] The various embodiments in this specification are described in a related manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

[0099] In particular, the device embodiment is basically similar to the method embodiment, so the description is relatively simple. For relevant details, please refer to the description of the method embodiment.

[0100] For ease of description, the above apparatus is described by dividing it into various functional units / modules. Of course, in implementing this invention, the functions of each unit / module can be implemented in one or more software and / or hardware.

[0101] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc.

[0102] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for analyzing the operating status of a terminal device, characterized in that, Including the following steps: The process involves acquiring operational data from the terminal device and determining object tags for that operational data. The determination of object tags for the operational data includes: extracting feature values ​​from the operational data; and determining object tags for the operational data based on those feature values. The operational data includes one or more of the following: terminal device hardware and software data, system operation behavior data, and network traffic log data. Each type of data includes multiple data objects. The object tag is an identity tag used to identify the entity to which the data object points. The process of assigning corresponding clustering seed points based on the object labels of the terminal device's operating data includes: determining preliminary clustering categories and their number using a decision tree structure with no branching leaf nodes based on the object labels of the terminal device's operating data; the preliminary clustering category is the clustering seed point. The cluster centers to which the cluster seed points belong are calculated based on the clustering algorithm. The calculation of the cluster centers to which the cluster seed points belong includes: calculating the distance from each cluster seed point to each cluster center; sequentially comparing the distances from each cluster seed point to each cluster center; determining the cluster center closest to each cluster seed point as the cluster center of the cluster to which the cluster seed point belongs; recalculating and determining the cluster center of each cluster for all cluster seed points; after determining the cluster center closest to each cluster seed point as the cluster center to which the cluster seed point belongs, the process includes: dividing all cluster seed points into an equal number of clusters based on the number of cluster seed points determined by the decision tree; calculating the distances between clusters; comparing the obtained distances between clusters with a preset screening threshold; and removing clusters whose distances between clusters are greater than the preset screening threshold. Random forest fitting is performed on the cluster centers to which the obtained cluster seed points belong to obtain unbiased prediction values ​​of the cluster centers to which the cluster seed points belong. Based on the unbiased predicted values ​​of the cluster centers to which the cluster seed points belong and their corresponding cluster seed points, a Gaussian distribution map of the cluster seed points is generated. The operating status of the terminal device is determined based on the Gaussian distribution map of the cluster seed points.

2. The terminal device operation status analysis method according to claim 1, characterized in that, The step of generating a Gaussian distribution map of the cluster seed points based on the unbiased predicted values ​​of the cluster centers to which the cluster seed points belong and their corresponding cluster seed points includes: Based on the unbiased predicted value of the cluster center to which the cluster seed point belongs and its corresponding cluster seed point, the Gaussian distribution word frequency distribution area of ​​the cluster seed point and the corresponding distribution area landing probability are calculated according to the Gaussian distribution formula. The Gaussian distribution map of the cluster seed points is generated based on the Gaussian distribution frequency distribution area of ​​the obtained cluster seed points and the corresponding distribution area landing probability.

3. The terminal device operation status analysis method according to claim 1, characterized in that, The operational data includes: abnormal operational data; After calculating the Gaussian distribution frequency distribution area of ​​the clustering seed point and the corresponding probability of the distribution area landing point according to the Gaussian distribution formula, the method further includes: Based on the Gaussian distribution word frequency distribution area of ​​the obtained clustering seed points and the corresponding distribution area landing probability, abnormal status classification alarm data of terminal devices are generated.

4. A terminal equipment operation status analysis device, characterized in that, The device includes: An acquisition module is used to acquire the operating data of the terminal device and determine the object tag of the operating data of the terminal device; wherein, determining the object tag of the operating data of the terminal device includes: extracting the feature values ​​of the operating data; determining the object tag of the operating data based on the feature values ​​of the operating data; the operating data includes one or three of the following: terminal device hardware and software data, system operation behavior data, and network traffic log data, each type of data including multiple data objects; the object tag is an identity tag used to identify the subject to which the data object points; A program module is configured to specify corresponding clustering seed points based on the object labels of the terminal device's operating data; specifying corresponding clustering seed points based on the object labels of the terminal device's operating data includes: determining preliminary clustering categories and their numbers using a decision tree structure with no branching leaf nodes based on the object labels of the terminal device's operating data; the preliminary clustering categories are the clustering seed points; The clustering module calculates the cluster centers to which the seed points belong based on a clustering algorithm. This calculation includes: calculating the distance from each seed point to each cluster center; sequentially comparing the distances from each seed point to each cluster center; determining the cluster center closest to each seed point as the cluster center of the cluster to which the seed point belongs; recalculating and determining the cluster center of each cluster for all seed points within each cluster; after determining the cluster center closest to each seed point, the module further includes: dividing all seed points into equal clusters based on the number of seed points determined by the decision tree; calculating the distances between clusters; comparing the obtained distances between clusters with a preset screening threshold; and removing clusters whose distances are greater than the preset screening threshold. The fitting program module is used to perform random forest fitting on the cluster centers to which the obtained cluster seed points belong, and obtain the unbiased prediction values ​​of the cluster centers to which the cluster seed points belong. The generation module is used to generate a Gaussian distribution map of the cluster seed points based on the unbiased prediction values ​​of the cluster centers to which the cluster seed points belong and their corresponding cluster seed points. The program module is used to determine the operating status of the terminal device based on the Gaussian distribution map of the clustering seed points.

5. The terminal equipment operation status analysis device according to claim 4, characterized in that, The generation program module includes: The third calculation program unit is used to calculate the Gaussian distribution word frequency distribution area of ​​the cluster seed point and the corresponding distribution area landing probability based on the unbiased predicted value of the cluster center to which the cluster seed point belongs and the corresponding cluster seed point, according to the Gaussian distribution formula. A generation program unit is used to generate a Gaussian distribution map of the clustering seed points based on the obtained Gaussian distribution word frequency distribution area and the corresponding distribution area landing probability.

6. The terminal device operation status analysis device according to claim 5, characterized in that, The operational data includes: abnormal operational data; The generation program unit is also used to generate abnormal status classification alarm data of the terminal device based on the Gaussian distribution word frequency distribution area of ​​the obtained clustering seed points and the corresponding distribution area landing probability.

7. An electronic device, characterized in that, The electronic device includes: a housing, a processor, a memory, a circuit board, and a power supply circuit, wherein the circuit board is disposed inside the space enclosed by the housing, and the processor and the memory are disposed on the circuit board; the power supply circuit is used to supply power to various circuits or devices of the electronic device; the memory is used to store executable program code; the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, for executing the method described in any one of claims 1 to 3.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores one or more programs, which can be executed by one or more processors to implement the method described in any one of claims 1 to 3.

Images