Instruction determination method, apparatus and storage medium

Abstract

This application relates to the field of communication technology, and in particular to an instruction determination method, apparatus, and storage medium thereof, capable of accurately identifying non-compliant high-risk instructions. The method includes: acquiring timestamps of multiple high-risk instructions; determining a dense operation period based on the timestamps of the multiple high-risk instructions; the dense operation period being a period in which the number of high-risk instructions meets a preset condition; determining a first target period based on the dense operation period; the first target period being a period before and / or after the dense operation period; acquiring multiple network indicators for the first target period; the multiple network indicators being indicators related to the multiple high-risk instructions; determining abnormal network indicators based on the multiple network indicators for the first target period; and determining high-risk instructions related to the abnormal network indicators as non-compliant high-risk instructions. This application is used in the instruction determination process.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to an instruction determination method, apparatus and storage medium thereof. Background Technology

[0002] In related technologies, ensuring the compliant execution of high-risk instructions relies on manual methods, which are largely subjective. These include leadership approval and account authorization before high-risk instructions are carried out. However, we lack an objective way to determine whether operators are following instructions. Therefore, accurately identifying non-compliant high-risk instructions is a pressing issue that needs to be addressed. Summary of the Invention

[0003] This application provides an instruction determination method, apparatus, and storage medium thereof, which can accurately determine non-compliant high-risk instructions.

[0004] To achieve the above objectives, this application adopts the following technical solution:

[0005] In a first aspect, this application provides a method for determining instructions, the method comprising: acquiring timestamps of multiple high-risk instructions; determining a period of intensive operation based on the timestamps of the multiple high-risk instructions; the period of intensive operation being a period in which the number of high-risk instructions meets a preset condition; determining a first target period in based on the period of intensive operation; the first target period being a period in time before and / or after the period of intensive operation; acquiring multiple network indicators for the first target period; the multiple network indicators being indicators related to the multiple high-risk instructions; determining abnormal network indicators based on the multiple network indicators for the first target period; and determining that the high-risk instructions related to the abnormal network indicators are non-compliant high-risk instructions.

[0006] In conjunction with the first aspect, in one possible implementation, if the first target time period is a time period preceding the intensive operation time period; determining abnormal network indicators based on multiple network indicators of the first target time period includes: inputting multiple network indicators of the first target time period into a preset model to predict the predicted value of each of the multiple network indicators within a second target time period; the second target time period is a time period following the intensive operation time period; determining the measured value of each network indicator within the second target time period; determining the target difference between the predicted value and the measured value of each network indicator; and determining network indicators whose target difference is greater than or equal to a threshold as abnormal network indicators.

[0007] In conjunction with the first aspect, in one possible implementation, if the first target time period is a time period following the intensive operation time period, determining at least one abnormal indicator among the network indicators includes: monitoring whether the indicator value of each network indicator among the multiple network indicators of the first target time period is an abnormal value; and determining the network indicator with an abnormal value as an abnormal network indicator.

[0008] In conjunction with the first aspect, in one possible implementation, the method further includes: determining the start and end timestamps of high-risk instructions in the operation log database; determining, based on the start and end timestamps, whether the high-risk instructions in the operation log database exist within a third target time period; if the high-risk instructions in the operation log database exist within the third target time period, determining that the high-risk instructions in the operation log database are compliant high-risk instructions; if the high-risk instructions in the operation log database do not exist within the third target time period, determining that the high-risk instructions in the operation log database are non-compliant high-risk instructions.

[0009] In conjunction with the first aspect, in one possible implementation, obtaining the timestamps of multiple high-risk instructions includes: determining a high-risk instruction database and an operation log database; the high-risk instruction database includes: instruction identifiers of high-risk instructions; the operation log database includes: IP address information, operation instruction identifiers, timestamps, and operating users; extracting operation instruction identifiers from the operation log database that match the instruction identifiers of the high-risk instructions, as the multiple high-risk instructions; and determining the timestamps of the multiple high-risk instructions.

[0010] Secondly, this application provides an instruction determination device, comprising: a processing unit and an acquisition unit; the acquisition unit is configured to acquire timestamps of multiple high-risk instructions; the processing unit is configured to determine a period of intensive operation based on the timestamps of the multiple high-risk instructions; the period of intensive operation is a period in which the number of high-risk instructions meets a preset condition; the processing unit is further configured to determine a first target period in relation to the period of intensive operation; the first target period is a period before and / or after the period of intensive operation; the acquisition unit is further configured to acquire multiple network indicators for the first target period; the multiple network indicators are indicators related to the multiple high-risk instructions; the processing unit is further configured to determine abnormal network indicators based on the multiple network indicators for the first target period; the processing unit is further configured to determine that the high-risk instructions related to the abnormal network indicators are non-compliant high-risk instructions.

[0011] In conjunction with the second aspect, in one possible implementation, if the first target time period is a time period preceding the intensive operation time period; the processing unit is specifically configured to: input multiple network indicators of the first target time period into a preset model, predict the predicted value of each of the multiple network indicators within a second target time period; the second target time period is a time period following the intensive operation time period; determine the measured value of each network indicator within the second target time period; determine the target difference between the predicted value and the measured value of each network indicator; and determine network indicators whose target difference is greater than or equal to a threshold as abnormal network indicators.

[0012] In conjunction with the second aspect, in one possible implementation, if the first target time period is a time period following the intensive operation time period, the processing unit is specifically used to: monitor whether the index value of each network index among multiple network indicators in the first target time period is an outlier; and determine that the network index with an outlier value is an abnormal network index.

[0013] In conjunction with the second aspect, in one possible implementation, the processing unit is further configured to: determine the start and end timestamps of high-risk instructions in the operation log database; determine, based on the start and end timestamps, whether the high-risk instructions in the operation log database exist within a third target time period; if the high-risk instructions in the operation log database exist within the third target time period, determine that the high-risk instructions in the operation log database are compliant high-risk instructions; if the high-risk instructions in the operation log database do not exist within the third target time period, determine that the high-risk instructions in the operation log database are non-compliant high-risk instructions.

[0014] In conjunction with the second aspect, in one possible implementation, the processing unit is further configured to: determine a high-risk instruction database and an operation log database; the high-risk instruction database includes: instruction identifiers of high-risk instructions; the operation log database includes: IP address information, operation instruction identifiers, timestamps, and operating users; extract operation instruction identifiers from the operation log database that match the instruction identifiers of the high-risk instructions, as the plurality of high-risk instructions; and determine the timestamps of the plurality of high-risk instructions.

[0015] Thirdly, this application provides an instruction determination apparatus, which includes: a processor and a communication interface; the communication interface and the processor are coupled, and the processor is used to run computer programs or instructions to implement the instruction determination method as described in the first aspect and any possible implementation thereof.

[0016] Fourthly, this application provides a computer-readable storage medium storing instructions that, when executed on a terminal, cause the terminal to perform the instruction determination method as described in the first aspect and any possible implementation thereof.

[0017] In this application, the names of the devices determined by the aforementioned instructions do not limit the devices or functional modules themselves. In actual implementation, these devices or functional modules may appear under other names. As long as the functions of each device or functional module are similar to those in this application, they fall within the scope of the claims of this application and their equivalents.

[0018] These or other aspects of this application will become more readily apparent in the following description.

[0019] Based on the above technical solutions, this application provides an instruction determination method, which includes: first, an instruction determination device acquires timestamps of multiple high-risk instructions, and determines a period of intensive operation based on the timestamps of the multiple high-risk instructions; second, the instruction determination device acquires multiple network indicators related to the period before and / or after the intensive operation period; and third, the instruction determination device determines abnormal network indicators based on the multiple network indicators of a first target time period. By determining the abnormal network indicators through objective means, the high-risk instructions related to the abnormal network indicators are determined to be non-compliant high-risk instructions, thereby ensuring the security of network operations and accurately identifying non-compliant high-risk instructions. Attached Figure Description

[0020] Figure 1 A schematic diagram of the structure of an instruction determining device provided in this application;

[0021] Figure 2 A flowchart of an instruction determination method provided in this application;

[0022] Figure 3 A flowchart of another instruction determination method provided in this application;

[0023] Figure 4 A flowchart of another instruction determination method provided in this application;

[0024] Figure 5 A flowchart of another instruction determination method provided in this application;

[0025] Figure 6 A flowchart of another instruction determination method provided in this application;

[0026] Figure 7A schematic diagram of another instruction determining device provided in this application. Detailed Implementation

[0027] The instruction determination method, apparatus and storage medium provided in the embodiments of this application will be described in detail below with reference to the accompanying drawings.

[0028] In this article, the term "and / or" is merely a description of the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can represent three situations: A exists alone, A and B exist simultaneously, and B exists alone.

[0029] The terms "first" and "second," etc., used in the specification and drawings of this application are used to distinguish different objects or to distinguish different treatments of the same object, rather than to describe a specific order of objects.

[0030] Furthermore, the terms "comprising" and "having," and any variations thereof, used in the description of this application are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the steps or units listed, but may optionally include other steps or units not listed, or may optionally include other steps or units inherent to such process, method, product, or apparatus.

[0031] It should be noted that in the embodiments of this application, the words "exemplary" or "for example" are used to indicate examples, illustrations, or explanations. Any embodiment or design scheme described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design schemes. Specifically, the use of the words "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0032] The KDDI telecommunications incident in Japan served as a wake-up call for all telecom operators' maintenance personnel. Ensuring network security for user terminals and maintaining standardized network operations are paramount for all operators. According to network maintenance operation procedures, to avoid impacting user terminal network usage during operations, maintenance personnel are required to perform network cutover operations between midnight and 6:00 AM.

[0033] Currently, network operation commands can be categorized into three types: ordinary query commands, general operation commands, and high-risk commands. Ordinary query commands are those that query network information; their execution does not change network configuration and therefore has no impact on the network. General operation commands, while altering network configuration to some extent, do not pose significant network risks. High-risk commands, however, refer to operations executed on network devices that could potentially cause significant network risks. Given the significant impact of high-risk command operations on network security, operators need to strengthen the control of high-risk command operations through processes and mechanisms to mitigate network security risks caused by misoperation or improper operation. Ensuring the compliant execution of high-risk command operations is paramount to guaranteeing network operational security.

[0034] In related technologies, ensuring the compliant execution of high-risk instructions relies on manual methods, which are largely subjective. These include leadership approval and account authorization before high-risk instructions are carried out. However, we lack an objective way to determine whether operators are following instructions. Therefore, accurately identifying non-compliant high-risk instructions is a pressing issue that needs to be addressed.

[0035] To address the problems in the prior art, embodiments of this application provide an instruction determination method. The method includes: first, an instruction determination device acquires timestamps of multiple high-risk instructions and determines a period of intensive operation based on the timestamps; second, the instruction determination device determines a period before and / or after the intensive operation period based on the intensive operation period; third, the instruction determination device acquires multiple network indicators related to the period before and / or after the intensive operation period; and fourth, the instruction determination device determines abnormal network indicators based on the multiple network indicators of a first target time period. By objectively determining the abnormal network indicators, the high-risk instructions related to the abnormal network indicators are determined to be non-compliant high-risk instructions, thereby ensuring the security of network operations and accurately identifying non-compliant high-risk instructions.

[0036] Figure 1 This is a schematic diagram of the structure of an instruction determining device provided in an embodiment of this application, as shown below. Figure 1 As shown, the instruction determining device 100 includes at least one processor 101, a communication line 102, and at least one communication interface 104, and may also include a memory 103. The processor 101, memory 103, and communication interface 104 are connected via the communication line 102.

[0037] The processor 101 may be a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of this application, such as one or more digital signal processors (DSPs), or one or more field-programmable gate arrays (FPGAs).

[0038] Communication line 102 may include a path for transmitting information between the aforementioned components.

[0039] The communication interface 104 is used to communicate with other devices or communication networks. It can use any transceiver-like device, such as Ethernet, radio access network (RAN), wireless local area network (WLAN), etc.

[0040] The memory 103 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of including or storing desired program code having the form of instructions or data structures and accessible by a computer, but not limited thereto.

[0041] In one possible design, the memory 103 can exist independently of the processor 101, meaning the memory 103 can be an external memory of the processor 101. In this case, the memory 103 can be connected to the processor 101 via the communication line 102 to store execution instructions or application code, and its execution is controlled by the processor 101 to implement the network quality determination method provided in the following embodiments of this application. In another possible design, the memory 103 can also be integrated with the processor 101, meaning the memory 103 can be an internal memory of the processor 101. For example, the memory 103 can be a cache, which can be used to temporarily store some data and instruction information.

[0042] As one possible implementation, processor 101 may include one or more CPUs, for example Figure 1 CPU0 and CPU1 in the example. Alternatively, the instruction determination device 100 may include multiple processors, such as CPU0 and CPU1. Figure 1 The processors 101 and 107 are included. Alternatively, the instruction determination apparatus 100 may further include an output device 105 and an input device 106.

[0043] Through the above description of the implementation methods, those skilled in the art will clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the network node can be divided into different functional modules to complete all or part of the functions described above. The specific working process of the system, modules, and network nodes described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0044] like Figure 2 The diagram shows a flowchart of an instruction determination method provided in an embodiment of this application. This instruction determination method can be applied to, for example... Figure 1 In the instruction determination device shown, the instruction determination method provided in this application embodiment can be implemented through the following steps.

[0045] S201, The instruction determination device acquires the timestamps of multiple high-risk instructions.

[0046] S202, The instruction determination device determines the period of intensive operation based on the timestamps of multiple high-risk instructions.

[0047] The intensive operation period is the time period in which the number of high-risk instructions meets the preset conditions.

[0048] For example, the instruction determination device uses a time sliding window algorithm to merge point-like operation times on the timeline into dense operation time periods. The instruction determination device uses 15 minutes as a cell. If the cell value is 1, it indicates that there is a high-risk instruction operation. If the cell value is 0, it indicates that there is no high-risk instruction operation. The implementation of the time sliding window algorithm is shown in Table 1 below. The cell at the current time point, the cells at the previous two time points, and the cells at the next two time points are added to determine five time point cells. It monitors whether there are more than or equal to 3 "1"s in the cells at these five time points. If there are more than or equal to 3, the sliding window at that time point is merged into "1". If there are less than 3, the sliding window at that time point is merged into "0".

[0049] Table 1 Sliding Window Algorithm

[0050]

[0051] According to the table above, after merging the sliding windows, the time period with consecutive "1"s is defined as the "intensive operation period"; that is, the intensive operation period is assumed to be from 8:00 to 9:00 AM or from 12:00 to 1:00 PM.

[0052] S203. The instruction determination device determines the first target time period based on the intensive operation time period.

[0053] The first target time period is the time period before and / or after the intensive operation period.

[0054] Referring to the example in S202, taking 8:00 AM to 9:00 AM as an example, the instruction determining device determines the 7 days before 8:00 AM to 9:00 AM as the first target time period; the instruction determining device can also determine the 8 hours after 8:00 AM to 9:00 AM as the first target time period.

[0055] S204, The instruction determination device acquires multiple network indicators for the first target time period.

[0056] Among them, several network metrics are related to several high-risk commands.

[0057] Referring to the example in S203, the instruction determines that the device acquires multiple network metrics for 7 days prior to 8:00 to 9:00 or for 8 hours after 8:00 to 9:00.

[0058] It is worth noting that several network metrics may be affected by high-risk commands; if they are not affected, it means that the high-risk commands were executed successfully.

[0059] S205. The instruction determination device determines abnormal network indicators based on multiple network indicators in the first target time period.

[0060] In one possible implementation, the instruction determining device determines abnormal network indicators based on the indicator values ​​of multiple network indicators during the first target time period, as detailed in S301 to S304 and S401 to S402.

[0061] S206. The instruction determination device determines that high-risk instructions related to abnormal network indicators are non-compliant high-risk instructions.

[0062] As one possible implementation, the above-mentioned S206 implementation process can be as follows: if abnormal network indicators appear among multiple network indicators, it indicates that there are non-compliant high-risk instructions during the intensive operation period. At this time, the instruction determination device can use regular expressions to match the IP address information, operation instruction identifier, operation user, and timestamp of the high-risk instruction, and at the same time perform visualization processing on the high-risk instruction.

[0063] Based on the above technical solution, this application provides an instruction determination method, which includes: first, an instruction determination device acquires the timestamps of multiple high-risk instructions, and determines a period of intensive operation based on the timestamps of the multiple high-risk instructions; the instruction determination device determines the time period before and / or after the period of intensive operation based on the period of intensive operation; second, the instruction determination device acquires multiple network indicators for the time period before and / or after the period of intensive operation; finally, the instruction determination device determines abnormal network indicators based on the multiple network indicators of a first target time period; by objectively determining the abnormal network indicators, the high-risk instructions related to the abnormal network indicators are determined to be non-compliant high-risk instructions, thereby ensuring the security of network operations and accurately determining non-compliant high-risk instructions.

[0064] In one possible implementation, combining Figure 2 ,like Figure 3 As shown, if the first target time period is the time period before the intensive operation period; the above-mentioned S205 and instruction determination device determine the abnormal network indicators based on multiple network indicators of the first target time period, which can be specifically implemented through the following S301-S304.

[0065] S301, The instruction determining device inputs multiple network indicators of the first target time period into the preset model and predicts the predicted value of each network indicator among the multiple network indicators in the second target time period.

[0066] The second target time period is the period following the period of intensive operations.

[0067] It's worth noting that by counting back 7 days from the start time of the intensive operation period, the first target period can be defined as that 7-day period. This means that multiple network metrics within the first target period were not affected by the multiple high-risk commands during the intensive operation period. These network metrics within that 7-day period are updated every 15 minutes.

[0068] As one possible implementation, the above-mentioned S301 process can be as follows: The instruction determining device inputs multiple network indicators of the first target time period into the model of the time series prediction algorithm. Based on multiple network indicators that were not affected by multiple high-risk instructions during the intensive operation period in the seven days prior to the intensive operation period, the device predicts the predicted value of each of the multiple network indicators for the next day after the intensive operation period. This predicted value is also a value that was not affected by multiple high-risk instructions. It can be understood that the predicted value is predicted every 15 minutes.

[0069] It is important to note that several network metrics include the number of real-time online users, session success rate, access failure rate, and domain name resolution success rate.

[0070] For example, the number of real-time online users (102) who were not affected by multiple high-risk commands 7 days ago, the session success rate (98%), the access failure rate (2%), and the domain name resolution success rate (92%) are input into the model of the time series prediction algorithm to predict the number of real-time online users (105) who were not affected by multiple high-risk commands one day after the period of intensive operation, the session success rate (99%), the access failure rate (1%), and the domain name resolution success rate (94%).

[0071] S302, The instruction determination device determines the measured value of each network indicator within the second target time period.

[0072] It is worth noting that the measurement value of each network indicator within the second target time period is the actual measurement value of each network indicator among multiple network indicators in the day following the intensive operation period.

[0073] For example, the instruction determination device determines the number of real-time online users affected by multiple high-risk instructions in a certain 15-minute period on a future day after the intensive operation period, which is 100; the session success rate is 95%; the access failure rate is 5%; and the domain name resolution success rate is 90%. That is to say, the above data are the real data of each network indicator in the real second target time period.

[0074] S303, The instruction determination device determines the target difference between the predicted value and the measured value of each network indicator.

[0075] Based on the examples of S301 and S302 above, the instruction determining device compares the predicted value and the measured value of each network indicator determined at the same time every 15 minutes, and determines that the target difference between the predicted value 105 of the number of real-time online users and the measured value 100 of the number of real-time online users is 5, the target difference between the predicted value 99% of the session success rate and the measured value 95% of the session success rate is 4%, the target difference between the predicted value 1% of the access failure rate and the measured value 5% of the access failure rate is -4%, and the target difference between the predicted value 94% of the domain name resolution success rate and the measured value 90% of the domain name resolution success rate is 4%.

[0076] S304. The instruction determination device determines network indicators whose target difference is greater than or equal to a threshold as abnormal network indicators.

[0077] Referring to the example in S303, if the instruction determining device determines that the target difference of 5 is greater than the threshold of 3, then the number of real-time online users of 100 is an abnormal network indicator; if the instruction determining device determines that the target difference of 4% is less than the threshold of 5%, then the session success rate of 95% is not an abnormal network indicator; if the instruction determining device determines that the target difference of -4% is equal to the threshold of -4%, then the access failure rate of 5% is an abnormal network indicator; if the instruction determining device determines that the target difference of 4% is less than the threshold of 5%, then the domain name resolution success rate of 90% is not an abnormal network indicator.

[0078] Based on the above technical solution, the instruction determination method provided in this application embodiment involves the instruction determination device inputting multiple network indicators of a first target time period into a preset algorithm to predict the predicted value of each network indicator in a second target time period that is not affected by high-risk instructions. This allows for the determination of the actual measured values ​​of multiple network indicators in the second target time period after the intensive operation period. The predicted values ​​are compared with the actual measured values ​​to determine the target difference. Finally, the instruction determination device determines network indicators that are greater than or equal to a threshold as abnormal network indicators based on the target difference, indicating that the abnormal network indicator is affected by multiple high-risk instructions, leading to errors.

[0079] In one possible implementation, combining Figure 2 ,like Figure 4 As shown, if the first target time period is the time period after the intensive operation period; the above-mentioned S205 and instruction determination device determine the abnormal network indicators based on multiple network indicators of the first target time period, which can be specifically implemented through the following S401-S402.

[0080] S401, The instruction determines whether the value of each network indicator among multiple network indicators monitored by the device during the first target time period is an abnormal value.

[0081] It is worth noting that the first target time period can be the 8-hour period following the period of intensive operations.

[0082] In one possible implementation, the instruction determination device feeds multiple network metrics from eight hours following the period of intensive operations into a streaming time series anomaly detection algorithm for monitoring. This algorithm uses a PyTorch-based autoencoder neural network for anomaly detection. An autoencoder is an unsupervised learning method that learns a latent representation of data and detects outliers that do not match that representation.

[0083] S402, The instruction determination device determines network indicators whose index values ​​are abnormal as abnormal network indicators.

[0084] It is worth noting that after the instruction determination device determines the abnormal network indicators, it can use the DingTalk robot interface to send the alarm text to the DingTalk group or use the Python SMTP package to send the parsed alarm form to the corresponding person.

[0085] Based on the above technical solution, the instruction determination method provided in this application embodiment allows the instruction determination device to simultaneously monitor multiple network indicators in the first target time period after the intensive operation period. If the network indicator with an abnormal value is determined, it is an abnormal network indicator, indicating that the network indicator is affected by multiple high-risk instructions. The instruction determination device can then issue an alarm for the abnormal network indicator.

[0086] In one possible implementation, combining Figure 2 ,like Figure 5 As shown, the above method also includes determining whether a high-risk instruction is non-compliant based on its start and end times, which can be implemented through the following S501-S504.

[0087] S501, The instruction determination device determines the start and end timestamps of high-risk instructions in the operation log database.

[0088] As one possible implementation, the above-mentioned S501 implementation process can be as follows: the operation log data stores the start time and end time of each operation instruction execution, and the instruction determination device determines the start and end timestamps of high-risk instructions in the operation log database.

[0089] For example, the instruction determination device determines that the start time of the high-risk instruction `echo "" > / dev / sda` in the operation log database is 0:07 on 2023 / 1 / 16 and the end time is 0:12 on 2023 / 1 / 16; at the same time, the instruction determination device determines that the start time of the high-risk instruction `mkfs.ext3 / dev / sdb` in the operation log database is 05:57 on 2023 / 1 / 16 and the end time is 06:10 on 2023 / 1 / 16.

[0090] S502. The instruction determination device determines whether a high-risk instruction exists in the operation log database within the third target time period based on the start and end timestamps.

[0091] For example, the instruction determination device determines whether the high-risk instruction `echo "" > / dev / sda` or the high-risk instruction `mkfs.ext3 / dev / sdb` exists between 0:00 and 06:00.

[0092] S503. If a high-risk instruction in the operation log database exists in the third target time period, the instruction determination device determines that the high-risk instruction in the operation log database is a compliant high-risk instruction.

[0093] Based on the examples in S501 and S502, the instruction determination device determines that the high-risk instruction `echo "" > / dev / sda` with a start time of 2023 / 1 / 16 0:07 and an end time of 2023 / 1 / 16 0:12 is a compliant high-risk instruction.

[0094] S504. If the high-risk instructions in the operation log database do not exist in the third target time period, the instruction determination device determines that the high-risk instructions in the operation log database are non-compliant high-risk instructions.

[0095] Based on the examples in S501 and S502, the instruction determination device determines that the high-risk instruction mkfs.ext3 / dev / sdb with a start time of 2023 / 1 / 16 05:57 and an end time of 2023 / 1 / 16 06:10 is an ineligible high-risk instruction.

[0096] It is worth noting that after identifying a non-compliant high-risk instruction, the instruction determination device highlights the non-compliant high-risk instruction and focuses attention on it.

[0097] Based on the above technical solution, the instruction determination method provided in this application embodiment determines whether the high-risk instruction is a compliant high-risk instruction by judging whether the start and end times of the high-risk instruction in the operation log data conform to the third target time period, and highlights the non-compliant high-risk instructions, focusing on monitoring the non-compliant high-risk instructions.

[0098] In one possible implementation, combining Figure 2 ,like Figure 6 As shown, the above-mentioned S201, the instruction determination device obtains the timestamps of multiple high-risk instructions, which can be specifically implemented through the following S601-S603.

[0099] S601, The instruction determination device determines the high-risk instruction database and the operation log database.

[0100] The high-risk instruction database includes: instruction identifiers for high-risk instructions; the operation log database includes: IP address information, operation instruction identifiers, timestamps, and operation users.

[0101] As one possible implementation, the above-mentioned S601 implementation process can be as follows: The instruction determination device stores a list of high-risk instructions that may cause significant network risks in a spreadsheet based on the execution of such instructions on network devices, and uses the read_excel, read_csv and to_sql functions of Pandas in Python to enter the instruction identifiers of the high-risk instructions into the database, thereby determining the high-risk instruction database.

[0102] The instruction determination device uses the network information collection function in Huawei 5GC network management system to upload the full operation logs of network elements involving high-risk operation instructions to a designated SFTP server at 00:15 every day on a daily cycle. The device then uses a Python program to decompress the compressed file on the SFTP server and, based on the patterns in path and filename, uses regular expressions to match the file paths of the required full network element operation logs in CSV format. It then uses the `read_csv` function from the Pandas module to read all the CSV files sequentially and merges them using the `pd.concat` command. The network element operation log files include: ordinary query instructions, general operation instructions, and high-risk instructions.

[0103] S602, The instruction determination device extracts the operation instruction identifier that matches the instruction identifier of the high-risk instruction from the operation log database and uses it as multiple high-risk instructions.

[0104] In one possible implementation, the instruction determination device uses regular expressions to match operation instruction identifiers in the operation log data that are consistent with the instruction identifiers of high-risk instructions, and identifies them as multiple high-risk instructions.

[0105] S603, The instruction determination device determines the timestamps of multiple high-risk instructions.

[0106] In one possible implementation, since the operation log database includes: IP address information, operation instruction identifier, timestamp, and operation user, the instruction determination device can determine the timestamps of multiple high-risk instructions.

[0107] Based on the above technical solutions, the instruction determination method provided in this application embodiment uses regular expressions to determine the operation instruction identifier in the operation log data that matches the instruction identifier of the high-risk instruction, which can greatly reduce the matching failure rate and improve the robustness of the method.

[0108] This application embodiment can divide the instruction determining device into functional modules or functional units according to the above method example. For example, each function can be divided into a separate functional module or functional unit, or two or more functions can be integrated into one processing module. The integrated module can be implemented in hardware or in software functional modules or functional units. The module or unit division in this application embodiment is illustrative and only represents one logical functional division; other division methods may be used in actual implementation.

[0109] like Figure 7 The diagram shows a schematic of an instruction determination device provided in an embodiment of this application. The device includes a processing unit 701 and an acquisition unit 702. The acquisition unit 702 is used to acquire timestamps of multiple high-risk instructions. The processing unit 701 is used to determine a period of intensive operation based on the timestamps of the multiple high-risk instructions. The period of intensive operation is a time period in which the number of high-risk instructions meets a preset condition. The processing unit 701 is also used to determine a first target time period based on the period of intensive operation. The first target time period is a time period before and / or after the period of intensive operation. The acquisition unit 702 is also used to acquire multiple network indicators for the first target time period. The multiple network indicators are indicators related to the multiple high-risk instructions. The processing unit 701 is also used to determine abnormal network indicators based on the multiple network indicators for the first target time period. The processing unit 701 is also used to determine that the high-risk instructions related to the abnormal network indicators are non-compliant high-risk instructions.

[0110] Optionally, if the first target time period is the time period before the intensive operation period; the processing unit 701 is specifically used to: input multiple network indicators of the first target time period into a preset model, predict the predicted value of each network indicator among the multiple network indicators in the second target time period; the second target time period is the time period after the intensive operation period; determine the measured value of each network indicator in the second target time period; determine the target difference between the predicted value and the measured value of each network indicator; and determine network indicators whose target difference is greater than or equal to a threshold as abnormal network indicators.

[0111] Optionally, if the first target time period is a time period following the intensive operation period, the processing unit 701 is specifically used to: monitor whether the indicator value of each network indicator among multiple network indicators in the first target time period is an outlier; and determine that the network indicator with an outlier value is an abnormal network indicator.

[0112] Optionally, the processing unit 701 is further configured to: determine the start and end timestamps of high-risk instructions in the operation log database; determine whether the high-risk instructions in the operation log database exist in the third target time period based on the start and end timestamps; if the high-risk instructions in the operation log database exist in the third target time period, determine that the high-risk instructions in the operation log database are compliant high-risk instructions; if the high-risk instructions in the operation log database do not exist in the third target time period, determine that the high-risk instructions in the operation log database are non-compliant high-risk instructions.

[0113] Optionally, the processing unit 701 is further configured to: determine a high-risk instruction database and an operation log database; the high-risk instruction database includes: instruction identifiers of high-risk instructions; the operation log database includes: IP address information, operation instruction identifiers, timestamps, and operation users; extract operation instruction identifiers from the operation log database that match the instruction identifiers of high-risk instructions, and use them as multiple high-risk instructions; determine the timestamps of the multiple high-risk instructions.

[0114] When implemented in hardware, the communication unit 702 in this embodiment can be integrated onto the communication interface, and the processing unit 701 can be integrated onto the processor. The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions within the technical scope disclosed in this application should be covered within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. An instruction determination method, characterized by, The method comprises: acquiring timestamps of a plurality of high-risk instructions; determining a time period of intensive operation based on the timestamps of the plurality of high-risk instructions; the time period of intensive operation is a time period in which the number of high-risk instructions meets a preset condition; determining a first target time period based on the time period of intensive operation; the first target time period is a time period before and / or after the time period of intensive operation; acquiring a plurality of network indicators of the first target time period; the plurality of network indicators are indicators related to the plurality of high-risk instructions; if the first target time period is a time period after the time period of intensive operation, monitoring whether an indicator value of each network indicator in the plurality of network indicators of the first target time period is an abnormal value; determining a network indicator with an abnormal value as an abnormal network indicator; determining a high-risk instruction related to the abnormal network indicator as a non-compliant high-risk instruction.

2. The method of claim 1, wherein, if the first target time period is a time period before the time period of intensive operation, inputting the plurality of network indicators of the first target time period into a preset model to predict a predicted value of each network indicator in the plurality of network indicators in a second target time period; the second target time period is a time period after the time period of intensive operation; determining a measured value of each network indicator in the second target time period; determining a target difference value between the predicted value and the measured value of each network indicator; determining a network indicator with a target difference value greater than or equal to a threshold value as an abnormal network indicator.

3. The method of claim 1, wherein, The acquiring of the timestamps of the plurality of high-risk instructions comprises: determining a high-risk instruction database and an operation log database; the high-risk instruction database comprises instruction identifiers of high-risk instructions; the operation log database comprises IP address information, operation instruction identifiers, timestamps, and operation users; extracting operation instruction identifiers consistent with the instruction identifiers of the high-risk instructions in the operation log database as the plurality of high-risk instructions; determining the timestamps of the plurality of high-risk instructions.

4. An instruction determination apparatus characterized by comprising: The device comprises a processing unit and an acquisition unit. The acquisition unit is configured to acquire timestamps of a plurality of high-risk instructions. The processing unit is configured to determine a time period of intensive operation based on the timestamps of the plurality of high-risk instructions; the time period of intensive operation is a time period in which the number of high-risk instructions meets a preset condition. The processing unit is further configured to determine a first target time period based on the time period of intensive operation; the first target time period is a time period before and / or after the time period of intensive operation. The acquisition unit is further configured to acquire a plurality of network indicators of the first target time period; the plurality of network indicators are indicators related to the plurality of high-risk instructions. The processing unit is further configured to monitor whether an indicator value of each network indicator in the plurality of network indicators of the first target time period is an abnormal value if the first target time period is a time period after the time period of intensive operation. The processing unit is further configured to determine a network indicator with an abnormal value as an abnormal network indicator. The processing unit is further configured to determine a high-risk instruction related to the abnormal network indicator as a non-compliant high-risk instruction.

5. The apparatus of claim 4, wherein, If the first target time period is a time period before the intensive operation time period, the processing unit is specifically configured to: input the network indicators in the first target time period into a preset model, and predict a predicted value of each network indicator in the network indicators in a second target time period; the second target time period is a time period after the intensive operation time period; determine a measured value of the each network indicator in the second target time period; determine a target difference between the predicted value and the measured value of the each network indicator; determine a network indicator with a target difference greater than or equal to a threshold value as an abnormal network indicator.

6. The apparatus of claim 4, wherein, The processing unit is further configured to determine a high-risk instruction database and an operation log database; the high-risk instruction database includes instruction identifiers of high-risk instructions; the operation log database includes IP address information, operation instruction identifiers, time stamps, and operation users; extract operation instruction identifiers consistent with the instruction identifiers of the high-risk instructions in the operation log database as the plurality of high-risk instructions; determine time stamps of the plurality of high-risk instructions.

7. An instruction determination apparatus characterized by comprising: comprise: a processor and a communication interface; the communication interface and the processor are coupled, and the processor is configured to run a computer program or instructions to implement the instruction determination method in any one of claims 1-3.

8. A computer-readable storage medium having stored therein instructions, the computer-readable storage medium comprising: When the computer executes the instructions, the computer executes the instruction determination method in any one of claims 1-3.

Images