A host safety monitoring method for power monitoring system

Abstract

The present application relates to a method for monitoring the host security of an electric power monitoring system. The method comprises: obtaining a flow data packet in a network communication, wherein the flow data packet includes at least one flow data; performing feature extraction on the flow data to obtain a flow feature corresponding to the flow data, wherein the flow data is flow data in the application layer of a monitoring host corresponding to the network communication; inputting the flow feature into a pre-trained support vector machine model to obtain at least one data type corresponding to the flow data, and performing a security judgment on the flow data based on the data type to obtain a first judgment result; if the first judgment result is that the flow data is malicious data, obtaining the security status information corresponding to the host, and saving the security status information to a security status area to generate a security status log. The use of this method can improve the accuracy and credibility of security monitoring.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a host security monitoring method for a power monitoring system. Background Art

[0002] With the development of computer technology, monitoring technology has emerged. At present, security intrusion detection is mainly distributed in various network nodes and edges. Although attack behaviors can be detected, it is impossible to determine whether the attacker has successfully compromised the target host, and whether the attack has caused a greater impact with the help of covert channels after the successful attack. Therefore, there are detection blind spots in network security equipment. In addition, attackers may delete log records after compromising the host, which has a certain impact on vulnerability impact investigation.

[0003] The network security risk of the monitoring system of new energy plants is the most concerned issue when they are attacked. When power plants face the highest level of targeted attacks (Advanced Persistent Threat, APT, advanced sustainable threats), how to discover attack behaviors, restore attack paths, determine the scope of attack impact, and collect attack evidence in security identification, etc. Therefore, how to accurately and reliably monitor host security is an urgent problem to be solved. Summary of the invention

[0004] Based on this, it is necessary to provide a method, device, computer equipment, computer-readable storage medium and computer program product capable of performing host security monitoring in response to the above technical problems.

[0005] In the first aspect, the present application provides a method for host security monitoring of a power monitoring system. The method includes: obtaining a flow data packet in a network communication, wherein the flow data packet includes at least one flow data; performing feature extraction on the flow data to obtain a flow feature corresponding to the flow data, wherein the flow data is flow data in the application layer of a monitoring host corresponding to the network communication; inputting the flow feature into a pre-trained support vector machine model to obtain at least one data type corresponding to the flow data, and performing a security judgment on the flow data based on the data type to obtain a first judgment result; if the first judgment result is that the flow data is malicious data, obtaining the security status information corresponding to the host, and saving the security status information to a security status area to generate a security status log.

[0006] In one of the embodiments, after obtaining the traffic data packet in the network communication, it also includes: parsing the data traffic packet to obtain data traffic information, wherein the data traffic information represents the size of the amount of information expressed by the data traffic packet; comparing the size of the data traffic information with a preset traffic threshold to obtain a second judgment result; if the second judgment result is that the size of the data traffic information is greater than the preset first threshold, access to the network is prohibited; if the second judgment result is that the size of the data traffic information is less than or equal to the preset first threshold, the system is kept operating normally or returns to monitoring identification.

[0007] In one of the embodiments, before parsing the data traffic packet to obtain data traffic information, wherein the data traffic information represents the amount of information expressed by the data traffic packet, it also includes: obtaining packet capture file information of all network cards corresponding to the monitoring host, and storing the packet capture file information in a preset format; determining whether the storage time corresponding to the packet capture file information stored in the current preset format exceeds a preset second threshold; obtaining a third determination result; if the third determination result is that the storage time exceeds the preset second threshold, deleting the information packet corresponding to the packet capture file information; if the third determination result is that the storage time meets the preset second threshold, obtaining the next corresponding packet capture file information.

[0008] In one of the embodiments, before parsing the data traffic packet to obtain data traffic information, wherein the data traffic information characterizes the size of the amount of information expressed by the data traffic packet, it also includes: obtaining all the traffic data packets transmitted in the network, wherein the traffic data packets include normal data and malicious data, wherein the normal data is data that can pass the security monitoring, and the malicious data is data intercepted by the security monitoring.

[0009] In one of the embodiments, the feature extraction of the flow data to obtain the flow characteristics corresponding to the flow data includes: obtaining application layer protocol flow in the flow data, and extracting characteristics of the application layer protocol flow to obtain protocol flow characteristics corresponding to the application layer protocol flow; when there is a file object in the application layer protocol flow, extracting characteristics of the file object to obtain file object characteristics corresponding to the file object; running the file object in the host and determining the file running characteristics related to the host according to the running results; and obtaining the flow characteristics corresponding to the flow data according to the protocol flow characteristics, the file object characteristics and the file running characteristics.

[0010] In one of the embodiments, after performing a security judgment on the traffic data based on the data type and obtaining a first judgment result, it also includes: if the first judgment result is that the traffic data is normal data, maintaining normal system operation or returning to monitoring identification.

[0011] In the second aspect, the present application also provides a host security monitoring device for a power monitoring system. The device includes: a flow data packet acquisition module, which is used to acquire flow data packets in network communications, wherein the flow data packets include at least one flow data; a flow feature acquisition module, which is used to perform feature extraction on the flow data to obtain flow features corresponding to the flow data, wherein the flow data is flow data in the application layer of the monitoring host corresponding to the network communication; a first judgment result acquisition module, which is used to input the flow features into a pre-trained support vector machine model to obtain at least one data type corresponding to the flow data, and perform security judgment on the flow data based on the data type to obtain a first judgment result; a malicious data processing module, which is used to obtain the security status information corresponding to the host if the first judgment result is that the flow data is malicious data, and save the security status information to the security status area to generate a security status log.

[0012] In one embodiment, the second judgment result processing module is used to parse the data flow packet to obtain data flow information, wherein the data flow information represents the size of the amount of information expressed by the data flow packet; compare the size of the data flow information with a preset flow threshold to obtain a second judgment result; if the second judgment result is that the size of the data flow information is greater than the preset first threshold, access to the network is prohibited; if the second judgment result is that the size of the data flow information is less than or equal to the preset first threshold, the system is kept running normally or the monitoring identification is returned.

[0013] In one of the embodiments, the monitoring module is used to obtain the packet capture file information of all network cards corresponding to the monitoring host, and store the packet capture file information in a preset format; determine whether the storage time corresponding to the packet capture file information stored in the current preset format exceeds a preset second threshold; obtain a third judgment result; if the third judgment result is that the storage time exceeds the preset second threshold, delete the information packet corresponding to the packet capture file information; if the third judgment result is that the storage time meets the preset second threshold, obtain the next corresponding packet capture file information.

[0014] In one of the embodiments, the monitoring module is also used to obtain all the traffic data packets transmitted in the network, and the traffic data packets include normal data and malicious data. The normal data is data that can pass the security monitoring, and the malicious data is data intercepted by the security monitoring.

[0015] In one of the embodiments, the traffic feature obtaining module is used to obtain the application layer protocol traffic in the traffic data, and perform feature extraction on the application layer protocol traffic to obtain the protocol traffic feature corresponding to the application layer protocol traffic;

[0016] When there is a file object in the application layer protocol traffic, feature extraction is performed on the file object to obtain file object features corresponding to the file object; the file object is run in the host, and file running features related to the host are determined based on the running results; and traffic features corresponding to the traffic data are obtained based on the protocol traffic features, the file object features and the file running features.

[0017] In one of the embodiments, the normal data processing module is used to keep the system running normally or return to monitoring identification if the first judgment result is that the traffic data is normal data.

[0018] In a third aspect, the present application also provides a computer device. The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the following steps when executing the computer program: obtaining a flow data packet in network communication, the flow data packet includes at least one flow data; performing feature extraction on the flow data to obtain a flow feature corresponding to the flow data, the flow data is flow data in the application layer of the monitoring host corresponding to the network communication; inputting the flow feature into a pre-trained support vector machine model to obtain at least one data type corresponding to the flow data, and performing a security judgment on the flow data based on the data type to obtain a first judgment result; if the first judgment result is that the flow data is malicious data, obtaining the security status information corresponding to the host, and saving the security status information to the security status area, and generating a security status log.

[0019] In a fourth aspect, the present application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the following steps are implemented: obtaining a flow data packet in network communication, wherein the flow data packet includes at least one flow data; performing feature extraction on the flow data to obtain a flow feature corresponding to the flow data, wherein the flow data is flow data in an application layer of a monitoring host corresponding to the network communication; inputting the flow feature into a pre-trained support vector machine model to obtain at least one data type corresponding to the flow data, and performing a security judgment on the flow data based on the data type to obtain a first judgment result; if the first judgment result is that the flow data is malicious data, obtaining security status information corresponding to the host, and saving the security status information to a security status area, and generating a security status log.

[0020] In a fifth aspect, the present application also provides a computer program product. The computer program product includes a computer program, which implements the following steps when executed by a processor: obtaining a flow data packet in network communication, wherein the flow data packet includes at least one flow data; performing feature extraction on the flow data to obtain a flow feature corresponding to the flow data, wherein the flow data is flow data in the application layer of a monitoring host corresponding to the network communication; inputting the flow feature into a pre-trained support vector machine model to obtain at least one data type corresponding to the flow data, and performing a security judgment on the flow data based on the data type to obtain a first judgment result; if the first judgment result is that the flow data is malicious data, obtaining security status information corresponding to the host, and saving the security status information to a security status area, and generating a security status log.

[0021] The above-mentioned power monitoring system host security monitoring method, device, computer equipment, storage medium and computer program product obtain a flow data packet in network communication, wherein the flow data packet includes at least one flow data; perform feature extraction on the flow data to obtain flow features corresponding to the flow data, wherein the flow data is flow data in the application layer of the monitoring host corresponding to the network communication; input the flow features into a pre-trained support vector machine model to obtain at least one data type corresponding to the flow data, and perform a security judgment on the flow data based on the data type to obtain a first judgment result; if the first judgment result is that the flow data is malicious data, obtain the security status information corresponding to the host, save the security status information to the security status area, and generate a security status log.

[0022] By acquiring traffic data packets in network communications, a large amount of traffic data can be directly and quickly transmitted to the server, reducing the interaction time between the server and the terminal; feature extraction is performed on the traffic data to obtain traffic features corresponding to the traffic data, and the traffic features can be used to represent the characteristics in the traffic data, further highlighting the characteristics of the traffic data; the traffic features are input into a pre-trained support vector machine model to obtain at least one data type corresponding to the traffic data, and a security judgment is made on the traffic data based on the data type to obtain a first judgment result, which can reduce the shortcomings brought about by manual classification, make the classification more accurate, improve the efficiency of classification, and further improve the accuracy of the judgment result; if the first judgment result is that the traffic data is malicious data, the security status information corresponding to the host is obtained, and the security status information is saved to the security status area, and a security status log is generated, which can intercept malicious data in time and record the interception situation, which is helpful for reviewing the interception situation.

[0023] The above method can improve the organization's intrusion detection capabilities, monitor the historical status information of its assets more comprehensively, quickly record intrusion logs for attack behaviors, determine the scope of attack impact in a timely manner, improve the organization's emergency response capabilities, and ensure the organization's business continuity. At the same time, reliable logs ensure the effectiveness of forensics. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 An application environment diagram of a method for safely monitoring a host computer of a power monitoring system in one embodiment;

[0025] Figure 2 A schematic diagram of a flow chart of a method for safely monitoring a host of a power monitoring system in one embodiment;

[0026] Figure 3 A schematic diagram of a flow chart of a host safety monitoring method of a power monitoring system in another embodiment;

[0027] Figure 4 A schematic diagram of a flow chart of a method for safely monitoring a host of a power monitoring system in another embodiment;

[0028] Figure 5 A schematic diagram of a flow chart of a method for safely monitoring a host of a power monitoring system in another embodiment;

[0029] Figure 6 It is a structural block diagram of a host safety monitoring device of a power monitoring system in one embodiment;

[0030] Figure 7 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0031] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0032] The host security monitoring method of the power monitoring system provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. The terminal 102 obtains data, the server 104 receives the data of the terminal 102 in response to the instruction of the terminal 102, and calculates the obtained data. The server 104 transmits the calculation result of the data back to the terminal 102, and the terminal 102 displays it. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. The server 104 obtains the flow data packet in the network communication from the terminal 102, and the flow data packet includes at least one flow data; extracts the characteristics of the flow data to obtain the flow characteristics corresponding to the flow data, and the flow data is the flow data in the application layer of the monitoring host corresponding to the network communication; inputs the flow characteristics into the pre-trained support vector machine model to obtain at least one data type corresponding to the flow data, and performs security judgment on the flow data based on the data type to obtain a first judgment result; if the first judgment result is that the flow data is malicious data, the security status information corresponding to the host is obtained, and the security status information is saved to the security status area to generate a security status log. The terminal 102 may be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, IoT devices, and portable wearable devices. The IoT devices may be smart speakers, smart TVs, smart air conditioners, smart car-mounted devices, etc. The portable wearable devices may be smart watches, smart bracelets, head-mounted devices, etc. The server 104 may be implemented as an independent server or a server cluster consisting of multiple servers.

[0033] In one embodiment, Figure 2 As shown, a method for host safety monitoring of a power monitoring system is provided, and the method is applied to Figure 1 The server in the example is used to illustrate the following steps:

[0034] Step 202, obtaining traffic data packets in network communication.

[0035] Among them, network communication can be achieved by connecting isolated devices through the network, and realizing communication between people, people and computers, and computers and computers through information exchange. The most important thing in network communication is the network communication protocol. There are three most commonly used network protocols in local area networks: MICROSOFT's NETBEUI, NOVELL's IPX / SPX and TCP / IP protocols.

[0036] The flow data packet may be a digital package formed by a series of processes from starting to using the product when the user accesses the product / page. The flow data packet contains the status data obtained by the monitoring module about the transmission from the terminal to the power monitoring system host.

[0037] Specifically, the server responds to the terminal's instructions and obtains at least one flow data packet from the terminal through network communication. The flow data packet includes at least one input data obtained by the monitoring module, which can be transmitted to the power monitoring system host and operate the host. The network communication here can use one of MICROSOFT's NETBEUI, NOVELL's IPX / SPX and TCP / IP protocols. After the server obtains the flow data packet, it stores the flow data packet in the server's storage unit. When the flow data packet needs to be used, the server will call the corresponding data from the storage unit to the server's central processor for calculation.

[0038] For example, server A obtains a large number of traffic data packets C from terminal B through network communication. These traffic data packets are sent by the terminal and are used to operate the operating data sent by the power monitoring system host. After server A obtains the traffic data packet C, it will store it in the server's storage unit.

[0039] Step 204: extract features from the traffic data to obtain traffic features corresponding to the traffic data.

[0040] Among them, the flow data can be the data obtained by the server from the terminal to operate the power monitoring system host. The flow data mainly comes from the terminal, and the operation of the power monitoring system host includes the real-time historical database XPMS, industrial automation configuration software, power automation software, "soft" control strategy software, communication gateway server, OPC products, Web portal tools, etc., which can be widely used in enterprise informatization, DCS system, PLC system, SCADA system.

[0041] Among them, traffic features can be feature vectors (features / feature vectors) obtained after feature extraction of traffic data through a pre-trained artificial intelligence model. A feature vector is a collection of attributes, usually represented by a vector, attached to an instance. Each sample has its own different attributes, and different attributes are represented by different attribute values. Multiple attribute values ​​combined together can be represented by a vector, which is called a feature vector.

[0042] Specifically, a pre-trained artificial intelligence model is used to extract features from the traffic data in the traffic data packet. The artificial intelligence model can be an analytical artificial intelligence model, a functional artificial intelligence model, an interactive artificial intelligence model, a text-based artificial intelligence model, and a visual artificial intelligence model. The server intelligently selects one of the artificial intelligence models based on the type of data and the target task requirements. The server can also make a selection through manual intervention to obtain the traffic characteristics corresponding to the traffic data. The traffic characteristics are generally represented by feature vectors.

[0043] For example, server A selects a functional artificial intelligence model (such as a long short-term memory network (LSTM)) from the artificial intelligence models for feature extraction based on the type of traffic data D in traffic data packet C and business requirements, and obtains the traffic feature E corresponding to the traffic data D in traffic data packet C.

[0044] Step 206: Input the traffic characteristics into a pre-trained support vector machine model to obtain at least one data type corresponding to the traffic data, and perform a security judgment on the traffic data based on the data type to obtain a first judgment result.

[0045] Among them, the support vector machine (SVM) can be a generalized linear classifier that performs binary classification of data in a supervised learning manner, and its decision boundary is the maximum-margin hyperplane solved for the learning sample. The support vector machine uses the hinge loss function to calculate the empirical risk and adds a regularization term to the solution system to optimize the structural risk. It is a classifier with sparsity and robustness. The support vector machine can perform nonlinear classification through the kernel method.

[0046] Among them, the data type can be the type of traffic data obtained by classifying the traffic data through the classifier of the artificial intelligence model, and the data type can be changed according to the classification type of the classifier as needed.

[0047] Among them, the security judgment can be to judge whether the data traffic in the data traffic package is harmful based on the data type. The judgment standard can be pre-set or the server can automatically adjust it according to the current situation.

[0048] The first judgment result may be a conclusion obtained after performing a security judgment on the traffic data. For the data obtained by the terminal, the first judgment result includes normal data and malicious data.

[0049] Specifically, the pre-trained support vector machine model has determined the type of classification, and the input of the flow feature can be directly classified. After the classification by the support vector machine model, the data type corresponding to the flow data is obtained, and based on the classified data type, it is input into a digital judge that can judge the security of the data type, and after judgment, the first judgment result is output. For the data required by the power monitoring system host, the first judgment result includes normal data and malicious data, etc. Among them, the support vector machine model here can be class SVC, NuSVC, LinearSVC, etc.

[0050] For example, the traffic feature E is input into a trained support vector machine model for classification. The support vector machine model selects SVC, obtains the data type corresponding to the traffic data D, and inputs the data type into a digital judge F for security judgment, and obtains a first judgment result corresponding to the traffic data D, for example, the first judgment result is malicious data.

[0051] Step 208: If the first judgment result is that the traffic data is malicious data, the security status information corresponding to the host is obtained, and the security status information is saved in the security status area to generate a security status log.

[0052] Among them, malicious data can be data sent from the terminal and used to abnormally operate the power monitoring system host. The data contains at least one malicious operation instruction and some abnormal data, causing the power monitoring system host to have an operating error.

[0053] Among them, safety status information can be a collection of information that plays a safety role in power production. It includes many aspects, such as real-time voltage information, power change information, etc. It is a general term for information that has a safety impact on power production work in many aspects.

[0054] Among them, the security status area can be an area used to store security status information. This area is specially protected by the server and requires multiple verifications to modify the data therein. The security status information stored therein can be effectively protected from being tampered with.

[0055] Among them, the security status log can be a log file that records the attack situation every time the power monitoring system host is attacked by malicious data. For example, if the power monitoring system is attacked by abnormal operation, the specific information and situation of the abnormal operation attack will be recorded in the security status log.

[0056] Specifically, if the first judgment result obtained after the flow data is judged by the digital judge is malicious data, the server obtains the corresponding security status information in the power monitoring system host and checks the security status information. If a problem is found during the check, an alarm is issued. The obtained security status information will be saved to a security status area with multiple verifications for safe storage, and a corresponding security status log will be generated based on the above security issues to record security-related data.

[0057] For example, if the first judgment result shows that the flow data D is malicious data, server A immediately obtains the corresponding security status information H in the power monitoring system host, and saves the security status information H to the security status area I with a higher security level, and establishes a security status log J based on the malicious attack corresponding to the flow data D.

[0058] In the above-mentioned power monitoring system host security monitoring method, a flow data packet in network communication is obtained, and the flow data packet includes at least one flow data; feature extraction is performed on the flow data to obtain flow features corresponding to the flow data, and the flow data is flow data in the application layer of the monitoring host corresponding to the network communication; the flow features are input into a pre-trained support vector machine model to obtain at least one data type corresponding to the flow data, and a security judgment is made on the flow data based on the data type to obtain a first judgment result; if the first judgment result is that the flow data is malicious data, the security status information corresponding to the host is obtained, and the security status information is saved to the security status area to generate a security status log.

[0059] By acquiring traffic data packets in network communications, a large amount of traffic data can be directly and quickly transmitted to the server, reducing the interaction time between the server and the terminal; feature extraction is performed on the traffic data to obtain traffic features corresponding to the traffic data, and the traffic features can be used to represent the characteristics in the traffic data, further highlighting the characteristics of the traffic data; the traffic features are input into a pre-trained support vector machine model to obtain at least one data type corresponding to the traffic data, and a security judgment is made on the traffic data based on the data type to obtain a first judgment result, which can reduce the shortcomings brought about by manual classification, make the classification more accurate, improve the efficiency of classification, and further improve the accuracy of the judgment result; if the first judgment result is that the traffic data is malicious data, the security status information corresponding to the host is obtained, and the security status information is saved to the security status area, and a security status log is generated, which can intercept malicious data in time and record the interception situation, which is helpful for reviewing the interception situation.

[0060] The above method can improve the organization's intrusion detection capabilities, monitor the historical status information of its assets more comprehensively, quickly record intrusion logs for attack behaviors, determine the scope of attack impact in a timely manner, improve the organization's emergency response capabilities, and ensure the organization's business continuity. At the same time, reliable logs ensure the effectiveness of forensics.

[0061] In one embodiment, Figure 3 As shown, after obtaining the traffic data packet in the network communication, it also includes:

[0062] Step 302, parse the data flow packet to obtain data flow information.

[0063] Among them, data flow information can be a parameter that characterizes the amount of information expressed by a data flow packet. Depending on the information obtained by the terminal, the amount of data flow information carried by the data flow packet is also different. For the server, the terminal's maximum data flow acquisition capability is the maximum processing capability of the security monitoring system.

[0064] Specifically, the server parses the data flow packet obtained from the terminal, and obtains the information of the data flow corresponding to the data flow packet, which expresses the size of the information in the data flow packet. Among them, the parsing adopted by this technical solution can be but not limited to JOSN data parsing and XML data parsing. For JOSN data parsing: first create a JSON file, then include document.h and cocos-ext.h header files in the class, then obtain the JSON file path through File Utils, and parse the JSON data through the Document object, and finally obtain different types of data values. For XML data parsing: first create an XML file, then include the header file in the class and use the named file, then obtain the full path of the XML file, load the XML file, and finally obtain the element and parse it.

[0065] For example, server A parses data flow packet C obtained by terminal B, and the parsing solution adopts XML data parsing, and the size of the expression information amount corresponding to data flow packet C is obtained after parsing.

[0066] Step 304: compare the size of the data flow information with a preset first threshold to obtain a second judgment result.

[0067] Among them, the first threshold can be a traffic threshold, which can be a pre-set threshold or a threshold that changes in real time according to business needs and actual conditions. The threshold is used to compare with the size of data traffic information. If it is greater than the first threshold, plan one is adopted. If it is less than or equal to the first threshold, plan two is adopted.

[0068] The second judgment result may be a result obtained by comparing the size of the data flow information with the first threshold, and the result includes but is not limited to greater than, less than, and equal to.

[0069] Specifically, the size of the data flow information obtained after parsing the data flow packet is compared with a first threshold that is preset or set according to actual needs to obtain a second judgment result, which includes but is not limited to greater than, less than, and equal to.

[0070] For example, after parsing the data flow packet C, the information size N is obtained, which is further compared with the first threshold n to obtain the second judgment result corresponding to the data flow packet C.

[0071] Step 306, if the second judgment result is that the size of the data flow information is greater than the preset first threshold, access to the network is prohibited; if the second judgment result is that the size of the data flow information is less than or equal to the preset first threshold, the system is kept running normally or returns to monitoring identification.

[0072] Specifically, if the size of the data traffic information is compared with the first threshold and the comparison result is that the size of the data traffic information is greater than the first threshold, the interception system is triggered to intercept the data traffic packet and prohibit it from accessing the network. If the comparison result is that the size of the data traffic information is less than or equal to the first threshold, the interception system is not triggered, the data traffic packet enters the next step, and then the system maintains normal operation or returns to monitoring identification.

[0073] For example, if the size N of the information of the data traffic packet C is compared with the first threshold n, and it is found that N is greater than n, the interception system is triggered to intercept the data traffic packet C and prohibit it from accessing the network. If N is less than or equal to n, the interception system is not triggered, and the data traffic packet C enters the next step, and then the system maintains normal operation or returns to monitoring and identification.

[0074] In this embodiment, by comparing the size of the data flow information with a preset first threshold, data flow packets with excessively large data flow information can be filtered out to ensure that the resources of the power monitoring system host are not occupied by data flow packets with excessively large data flow information. At the same time, malicious traffic can be prevented from using methods that cause excessive data flow information to cause the power monitoring system host to be paralyzed.

[0075] In one embodiment, Figure 4 As shown, the data flow packet is parsed to obtain data flow information, and the data flow information represents the amount of information expressed in the data flow packet, and also includes:

[0076] Step 402, obtaining the packet capture file information of all network cards corresponding to the monitoring host, and storing the packet capture file information according to a preset format.

[0077] Among them, the packet capture file can be a file generated by obtaining corresponding data by means of packet capture. Packet capture is to intercept, resend, edit, transfer and other operations of data packets sent and received by network transmission, and is also used to check network security. Packet capture is also often used for data interception, etc.

[0078] Specifically, the server obtains corresponding data by capturing packets from all network cards corresponding to the monitoring host through network communication. The amount of data obtained after capturing packets should be less than the original amount of data, and generates captured packet file information, which is further stored in a preset format. The preset format may be, but is not limited to, pcap and cap formats. pcap and cap files are commonly used datagram storage formats, which can be understood as a file format, except that the data therein is stored in a specific format, so the data inside needs to be parsed and must also be in a certain format.

[0079] For example, server A obtains part of the data corresponding to all network cards in the monitoring host X by capturing packets and generates packet capture file information P, and then stores the packet capture file information P in a preset format pcap. The storage location is the storage unit of the server, and the central processor called from the storage unit can perform calculations at any time when needed.

[0080] Step 404, determine whether the storage time corresponding to the packet capture file information stored in the current preset format exceeds a preset second threshold; and obtain a third determination result.

[0081] Among them, the second threshold can be a time threshold, and the second threshold can be a threshold that is pre-set or changes in real time according to business needs and actual conditions. The threshold acts on the storage time corresponding to the captured file information. If it is greater than the second threshold, plan one is adopted; if it is less than or equal to the second threshold, plan two is adopted.

[0082] Among them, the third judgment result can be the result obtained by comparing the storage time corresponding to the captured file information with the second threshold value, and the result is limited to a combination of one or more of greater than, less than and equal to.

[0083] Specifically, the size of the storage time corresponding to the captured file information formed by capturing packets is compared with a second threshold that is preset or automatically set according to actual needs to obtain a third judgment result, which is limited to a combination of one or more of greater than, less than and equal to.

[0084] For example, after capturing packets based on the information of the monitoring host X, the storage time T of the captured packet file information P is obtained, which is further compared with the second threshold t to obtain the third judgment result corresponding to the captured packet file information P.

[0085] Step 406, if the third judgment result is that the storage time exceeds the preset second threshold, delete the information packet corresponding to the captured packet file information; if the third judgment result is that the storage time meets the preset second threshold, obtain the next corresponding captured packet file information.

[0086] Specifically, if the storage time corresponding to the captured file information is compared with the second threshold, and the comparison result is that the storage time is greater than the second threshold, the deletion system is triggered to delete the information packet corresponding to the captured file information; if the comparison result is that the storage time is less than or equal to the second threshold, the deletion system is not triggered, the information packet enters the next step, and then the next corresponding captured file information is obtained.

[0087] For example, if the storage time T corresponding to the captured packet file information P is compared with the second threshold t, and it is found that T is greater than t, the deletion system is triggered to delete the information packet corresponding to the captured packet file information P. If T is less than or equal to t, the deletion system is not triggered, the information packet enters the next step, and then the next corresponding captured packet file information P' is obtained.

[0088] In this embodiment, by obtaining the corresponding storage time in the packet capture file information and comparing the storage time with the second threshold, the packet capture file information with a storage time greater than the second threshold can be deleted, and the packet capture file information with a storage time less than or equal to the second threshold is retained, thereby preventing the power monitoring system host from receiving excessive packet capture file information and being unable to process it.

[0089] In one embodiment, the data flow packet is parsed to obtain data flow information, where the data flow information represents the amount of information expressed in the data flow packet, and the following steps are also included:

[0090] Step 502, obtaining all traffic data packets transmitted in the network.

[0091] Specifically, the data packet acquisition submodule in the system acquires all data flow packets transmitted through the network, and after acquiring all the data flow packets, further stores all the data flow packets.

[0092] For example, the data packet acquisition submodule acquires all data flow packets C transmitted through the network, and further stores all data flow packets C.

[0093] In this embodiment, by acquiring all traffic data packets transmitted in the network, it can be ensured that all traffic data packets are processed, ensuring that no data is left behind to cause a fault in the operation of the power monitoring system host.

[0094] In one embodiment, Figure 5 As shown, feature extraction is performed on the traffic data to obtain traffic features corresponding to the traffic data, including:

[0095] Step 602, obtaining application layer protocol traffic in the traffic data, and performing feature extraction on the application layer protocol traffic to obtain protocol traffic features corresponding to the application layer protocol traffic.

[0096] The application layer protocol traffic can be the data traffic transmitted through the network protocol in the application layer, so the transmission of the data traffic is stable, not easily affected by the outside world, and has a fast transmission speed. The three most commonly used network protocols in the local area network are MICROSOFT's NETBEUI, NOVELL's IPX / SPX and TCP / IP protocols.

[0097] Among them, the protocol traffic feature can be the protocol traffic feature vector (features / feature vector) obtained after the application layer protocol traffic is extracted through a pre-trained artificial intelligence model. The protocol traffic feature vector is a collection of attributes, usually represented by a vector, attached to an instance. Each sample has its own different attributes, and different attributes are represented by different attribute values. Multiple attribute values ​​combined together can be represented by a vector, which is called a protocol traffic feature vector.

[0098] Specifically, the server obtains the application layer protocol traffic located at the application layer. The traffic is transmitted using a network protocol to ensure the efficiency of the transmission. According to the requirements, the network protocol may include but is not limited to MICROSOFT's NETBEUI, NOVELL's IPX / SPX and TCP / IP protocols. The obtained application layer protocol traffic is subjected to feature extraction using a pre-trained artificial intelligence model to obtain the protocol traffic features corresponding to the application layer protocol traffic. The artificial intelligence model may be an analytical artificial intelligence model, a functional artificial intelligence model, an interactive artificial intelligence model, a textual artificial intelligence model, and a visual artificial intelligence model. The server intelligently selects one of the artificial intelligence models according to the type of data and the target's task requirements, or it may be selected through manual intervention. The protocol traffic features are generally represented by feature vectors.

[0099] For example, server A obtains the application layer protocol traffic K located at the application layer. According to the type of application layer protocol traffic K and business requirements, a functional artificial intelligence model (such as convolutional neural network (CNN)) is selected from the artificial intelligence model for feature extraction to obtain the protocol traffic feature L corresponding to the application layer protocol traffic K.

[0100] Step 604: When there is a file object in the application layer protocol traffic, feature extraction is performed on the file object to obtain file object features corresponding to the file object.

[0101] The file object may be data in various formats contained in the application layer protocol traffic, some of which are stored in the form of files. The file is called a file object when transmitting data.

[0102] Among them, the file object feature can be a file object feature vector (features / feature vector) obtained after the file object is extracted through a pre-trained artificial intelligence model. The file object feature vector is a collection of attributes, usually represented by a vector, attached to an instance. Each sample has its own different attributes, and different attributes are represented by different attribute values. Multiple attribute values ​​combined together can be represented by a vector, which is called a file object feature vector.

[0103] Specifically, when the server detects a file object in the application layer protocol traffic, the file object is extracted from the application layer protocol traffic, and the file object is feature extracted using an artificial intelligence model to obtain the file object features corresponding to the file object. The artificial intelligence model can be an analytical artificial intelligence model, a functional artificial intelligence model, an interactive artificial intelligence model, a textual artificial intelligence model, and a visual artificial intelligence model. The server intelligently selects one of the artificial intelligence models based on the type of file object and the target's task requirements, or it can be selected through manual intervention. The file object features are generally represented by feature vectors.

[0104] For example, when server A detects file object Y in application layer protocol traffic K, file object Y is extracted from the application layer protocol traffic K. According to the type of file object Y and business requirements, a functional artificial intelligence model (such as a recurrent neural network (RNN)) is selected from the artificial intelligence model for feature extraction to obtain the protocol traffic feature Z corresponding to file object Y.

[0105] Step 606: Run the file object in the host, and determine the file running characteristics related to the host according to the running result.

[0106] The file operation characteristics may be the characteristics of the file object after the operation is performed and reflected according to the operation status and the operation result.

[0107] Specifically, the server extracts the file object from the application layer protocol traffic, runs the file object, and monitors the running results output by the server in real time when running the file object, and determines the file running characteristics exhibited during and after the running of the file object based on the running results.

[0108] For example, server A discovers file object Y from application layer protocol traffic K, extracts file object Y from application layer protocol traffic K, and further sends it to server A for operation, and monitors the operation result f in real time. After the operation is completed, the file operation characteristics W exhibited by the file object during and after the operation are determined based on multiple operation results f.

[0109] Step 608, obtaining the flow characteristics corresponding to the flow data according to the protocol flow characteristics, the file object characteristics and the file operation characteristics.

[0110] Specifically, based on the above calculated and analyzed protocol flow characteristics, file object characteristics and file operation characteristics, the three characteristics are fused to obtain the flow characteristics corresponding to the flow data composed of the protocol flow characteristics, file object characteristics and file operation characteristics. The fusion of the protocol flow characteristics, file object characteristics and file operation characteristics can be a synthesis, addition and multiplication of the three characteristics.

[0111] For example, the protocol traffic feature L, the file object feature Z and the file operation feature W are fused using a synthesis method to obtain the traffic feature E corresponding to the traffic data D composed of the protocol traffic feature L, the file object feature Z and the file operation feature W.

[0112] In this embodiment, protocol flow characteristics, file object characteristics and file operation characteristics are obtained through feature extraction, and these three characteristics are combined, so that the flow characteristics corresponding to the flow data can have the above three characteristics, ensuring that the changes caused by various characteristics in the flow data packet are included, making the description of the flow characteristics more accurate.

[0113] In one embodiment, after performing security judgment on the traffic data based on the data type and obtaining the first judgment result, the method further includes:

[0114] Step 702: If the first judgment result is that the traffic data is normal data, the system is kept running normally or returns to monitoring identification.

[0115] Among them, normal data can be data sent from the terminal and used to normally operate the power monitoring system host. The data contains at least one reasonable operation instruction and some normal data, so that the power monitoring system host runs according to the preset instructions.

[0116] Specifically, if the first judgment result obtained after the traffic data is judged by the digital judge is normal data, the normal data is input to the next step, and the digital judge is reset to keep the system running normally or return to monitoring identification.

[0117] For example, if the first judgment result obtained after the traffic data D is judged by the digital judge is normal data, server A transmits the traffic data D corresponding to the normal data to the next step and resets the digital judge to keep the system running normally or return to monitoring identification.

[0118] In this embodiment, by reading the first judgment result, the server can transmit normal data to the next step in a timely manner, thereby ensuring the timeliness of the data.

[0119] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0120] Based on the same inventive concept, the embodiment of the present application also provides a power monitoring system host safety monitoring device for implementing the power monitoring system host safety monitoring method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more power monitoring system host safety monitoring device embodiments provided below can refer to the limitations of the power monitoring system host safety monitoring method above, and will not be repeated here.

[0121] In one embodiment, Figure 6 As shown, a security monitoring device is provided, including: a flow data packet acquisition module, a flow feature acquisition module, a first judgment result acquisition module and a malicious data processing module, wherein:

[0122] The flow data packet acquisition module 602 is used to acquire the flow data packet in the network communication, and the flow data packet includes at least one kind of flow data;

[0123] The flow feature acquisition module 604 is used to extract features from the flow data to obtain flow features corresponding to the flow data, where the flow data is flow data in the application layer of the monitoring host corresponding to the network communication;

[0124] A first judgment result obtaining module 606 is used to input the traffic characteristics into a pre-trained support vector machine model to obtain at least one data type corresponding to the traffic data, and perform security judgment on the traffic data based on the data type to obtain a first judgment result;

[0125] The malicious data processing module 608 is used to obtain the security status information corresponding to the host if the first judgment result is that the traffic data is malicious data, and save the security status information to the security status area to generate a security status log.

[0126] In one embodiment, the second judgment result processing module is used to parse the data flow packet to obtain data flow information, where the data flow information represents the size of the amount of information expressed in the data flow packet; compare the size of the data flow information with a preset flow threshold to obtain a second judgment result; if the second judgment result is that the size of the data flow information is greater than the preset first threshold, access to the network is prohibited; if the second judgment result is that the size of the data flow information is less than or equal to the preset first threshold, the system is kept running normally or the monitoring identification is returned.

[0127] In one of the embodiments, the monitoring module is used to obtain the packet capture file information of all network cards corresponding to the monitoring host, and store the packet capture file information in a preset format; determine whether the storage time corresponding to the packet capture file information stored in the current preset format exceeds a preset second threshold; obtain a third judgment result; if the third judgment result is that the storage time exceeds the preset second threshold, delete the information packet corresponding to the packet capture file information; if the third judgment result is that the storage time meets the preset second threshold, obtain the next corresponding packet capture file information.

[0128] In one of the embodiments, the monitoring module is also used to obtain all traffic data packets transmitted in the network, and the traffic data packets include normal data and malicious data. Normal data is data that can pass security monitoring, and malicious data is data intercepted by security monitoring.

[0129] In one of the embodiments, the traffic feature acquisition module is used to obtain the application layer protocol traffic in the traffic data, and perform feature extraction on the application layer protocol traffic to obtain the protocol traffic feature corresponding to the application layer protocol traffic;

[0130] When there is a file object in the application layer protocol traffic, feature extraction is performed on the file object to obtain file object features corresponding to the file object; the file object is run in the host, and the file running features related to the host are determined based on the running results; based on the protocol traffic features, file object features and file running features, the traffic features corresponding to the traffic data are obtained.

[0131] In one of the embodiments, the normal data processing module is used to keep the system running normally or return to monitoring identification if the first judgment result is that the traffic data is normal data.

[0132] Each module in the above-mentioned power monitoring system host safety monitoring device can be implemented in whole or in part by software, hardware and their combination. Each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the corresponding operations of each of the above modules.

[0133] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 7 As shown. The computer device includes a processor, a memory and a network interface connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store server data. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a host safety monitoring method of a power monitoring system is implemented.

[0134] Those skilled in the art will understand that Figure 7 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0135] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.

[0136] In one embodiment, a computer-readable storage medium is provided, storing a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0137] In one embodiment, a computer program product or computer program is provided, the computer program product or computer program includes computer instructions, the computer instructions are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device performs the steps in the above-mentioned method embodiments.

[0138] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0139] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0140] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0141] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A method for monitoring host safety of a power monitoring system, characterized in that: The method comprises: Obtaining a flow data packet in network communication; the flow data packet includes status data obtained by the monitoring module about the transmission from the terminal to the power monitoring system host; the flow data packet includes at least one flow data; the flow data is data obtained from the terminal for operating the power monitoring system host; the flow data is specifically used to operate at least one of the real-time historical database XPMS, industrial automation configuration software, power automation software, "soft" control strategy software, communication gateway server, OPC product, and Web portal tool in the power monitoring system host; Extracting features from the traffic data to obtain traffic features corresponding to the traffic data, wherein the traffic data is traffic data in an application layer of a monitoring host corresponding to the network communication; Input the traffic characteristics into a pre-trained support vector machine model to obtain at least one data type corresponding to the traffic data, and perform a safety judgment on the traffic data based on the data type to obtain a first judgment result; wherein a digital judge is used to perform a safety judgment on the traffic data; If the first judgment result is that the flow data is malicious data, the security status information corresponding to the host is obtained, and the security status information is saved in the security status area to generate a security status log; the malicious data is data sent from the terminal for abnormal operation of the power monitoring system host; the malicious data contains at least one malicious operation instruction and abnormal data, causing the power monitoring system host to have an operation error; If the first judgment result is that the flow data is normal data, the system maintains normal operation or returns to monitoring identification; the normal data is data sent from the terminal and used to normally operate the power monitoring system host; the normal data contains at least one reasonable operation instruction and normal data, so that the power monitoring system host appears to operate according to the preset instructions.

2. The method according to claim 1, characterized in that After obtaining the traffic data packet in the network communication, the method further includes: Parsing the data flow packet to obtain data flow information, wherein the data flow information represents the amount of information expressed by the data flow packet; Comparing the size of the data flow information with a preset first threshold to obtain a second judgment result; If the second judgment result is that the size of the data traffic information is greater than the preset first threshold, access to the network is prohibited; if the second judgment result is that the size of the data traffic information is less than or equal to the preset first threshold, the system is kept running normally or returns to monitoring identification.

3. The method according to claim 2, characterized in that Before the data flow packet is parsed to obtain data flow information, wherein the data flow information represents the amount of information expressed by the data flow packet, the method further includes: Obtaining the packet capture file information of all network cards corresponding to the monitoring host, and storing the packet capture file information in a preset format; Determine whether the storage time corresponding to the packet capture file information stored in the current preset format exceeds a preset second threshold; and obtain a third determination result; If the third judgment result is that the storage time exceeds the preset second threshold, the information packet corresponding to the captured packet file information is deleted; if the third judgment result is that the storage time meets the preset second threshold, the next corresponding captured packet file information is obtained.

4. The method according to claim 2, characterized in that: Before the data flow packet is parsed to obtain data flow information, wherein the data flow information represents the amount of information expressed by the data flow packet, the method further includes: All the traffic data packets transmitted in the network are acquired, wherein the traffic data packets include normal data and malicious data, wherein the normal data is data that can pass the security monitoring, and the malicious data is data intercepted by the security monitoring.

5. The method according to claim 1, characterized in that The extracting features of the flow data to obtain flow features corresponding to the flow data includes: Acquire application layer protocol traffic in the traffic data, and perform feature extraction on the application layer protocol traffic to obtain protocol traffic features corresponding to the application layer protocol traffic; When there is a file object in the application layer protocol flow, feature extraction is performed on the file object to obtain a file object feature corresponding to the file object; Running the file object in the host, and determining the file running characteristics related to the host according to the running result; The flow characteristics corresponding to the flow data are obtained according to the protocol flow characteristics, the file object characteristics and the file operation characteristics.

6. A host safety monitoring device for a power monitoring system, characterized in that: The device comprises: A flow data packet acquisition module is used to acquire flow data packets in network communication; the flow data packet includes status data obtained by the monitoring module about the transmission from the terminal to the power monitoring system host; the flow data packet includes at least one flow data; the flow data is data obtained from the terminal for operating the power monitoring system host; the flow data is specifically used to operate at least one of the real-time historical database XPMS, industrial automation configuration software, power automation software, "soft" control strategy software, communication gateway server, OPC product, and Web portal tool in the power monitoring system host; A flow feature obtaining module, used for extracting features from the flow data to obtain flow features corresponding to the flow data, wherein the flow data is flow data in the application layer of the monitoring host corresponding to the network communication; A first judgment result obtaining module is used to input the flow characteristics into a pre-trained support vector machine model to obtain at least one data type corresponding to the flow data, and perform a safety judgment on the flow data based on the data type to obtain a first judgment result; wherein a digital judge is used to perform a safety judgment on the flow data; A malicious data processing module, for obtaining security status information corresponding to the host if the first judgment result is that the flow data is malicious data, and saving the security status information to the security status area, and generating a security status log; the malicious data is data sent from the terminal for abnormal operation of the power monitoring system host; the malicious data contains at least one malicious operation instruction and abnormal data, causing the power monitoring system host to have an operation error; A normal data processing module is used to maintain the normal operation of the system or return to monitoring identification if the first judgment result is that the flow data is normal data; the normal data is data sent from the terminal and used to normally operate the power monitoring system host; the normal data contains at least one reasonable operation instruction and normal data, so that the power monitoring system host appears to operate according to the preset instructions.

7. The device according to claim 6, characterized in that The device also includes: a second judgment result processing module, which is used to parse the data traffic packet to obtain data traffic information, wherein the data traffic information represents the size of the amount of information expressed by the data traffic packet; compare the size of the data traffic information with a preset first threshold to obtain a second judgment result; if the second judgment result is that the size of the data traffic information is greater than the preset first threshold, access to the network is prohibited; if the second judgment result is that the size of the data traffic information is less than or equal to the preset first threshold, the system is kept in normal operation or returns to monitoring identification.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 5 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

Images