Data security processing method based on alarm threshold triggering combined with MTD algorithm

Abstract

The application discloses a kind of based on alarm threshold trigger combination MTD algorithm data security processing method.The kind of based on alarm threshold trigger combination MTD algorithm data security processing method includes the following steps: S1 real-time alarm data set acquisition;S2 operation and maintenance system abnormal alarm data capture: the real-time alarm data set obtained is compared using true value and dynamic threshold, and the operation and maintenance system abnormal alarm data is captured;S3 operation and maintenance system abnormal data processing.The application classifies the real-time alarm data of operation and maintenance system using alarm data monitoring index to obtain corresponding set, then captures operation and maintenance system abnormal alarm data using true value and dynamic threshold comparison, finally processes abnormal data according to the abnormal type of abnormal alarm data and the abnormal situation of operation and maintenance system at next moment through MTD algorithm, achieves the effect of improving data prediction accuracy, solves the problem of low data prediction accuracy in prior art.

Description

Technical Field

[0001] This invention relates to the field of intelligent operation and maintenance trend prediction technology, and in particular to a data security processing method based on alarm threshold triggering combined with MTD algorithm. Background Technology

[0002] Alarm thresholds are restrictions set during data security processing to trigger security alerts or take predefined security measures. In monitoring and security systems, setting appropriate alarm thresholds allows for timely detection and response to security incidents, thus ensuring system security. Moving Target Defense (MTD) is a dynamically changing security defense strategy that reduces the chances of successful attacks by frequently altering key elements such as system and network configurations, protocols, and topology. While alarm thresholds are used for timely detection and response to potential security incidents, the MTD algorithm increases the complexity of attacks and improves system security by changing the system environment. Trend prediction, also known as time-series prediction, is an important direction in artificial intelligence, as opposed to non-time-series prediction. Non-time-series predictions, such as predicting someone's income based on their age, years of work experience, and education level, involve input and output variables within the same time frame.

[0003] In the field of operations and maintenance, time-series data is predominantly used, with a demand for predicting trends at different future periods. For business operations with high time sensitivity, such as system failures and traffic changes, short-term trend predictions are needed, and these models primarily employ time-series forecasting models. These models extract time-varying features from the data manually or through algorithms, mining them as thoroughly as possible to predict values ​​at the next one or more time points. For medium- to long-term business operations such as resource planning and scheduling, medium- to long-term trend predictions are preferred, and these predictions typically do not rely on time-series forecasting models. This is because, given a fixed input data period, the longer the prediction timeframe, the larger the model's prediction error, the lower the reliability of the results, and ultimately, the less meaningful the prediction becomes.

[0004] For example, the invention patent with publication number CN114827126A discloses a method and system for reporting IPTVCDN user playback logs, including: S1, obtaining the log file content under the CDN node log directory; S2, reading the log file content line by line, splitting the log file according to the required saving format, and saving the split log file; S3, determining whether the session of the read log file content is alive: if the session is alive, then execute step S2; if the session ends, then execute step S4; S4, saving the log file content of S3; S5, determining whether to report the log file content based on the real-time indicators of the log file: if the determination result is to report, then execute step S6; if the determination result is not to report, then execute step S2; S6, reporting the log file content.

[0005] For example, the invention patent with publication number CN112653887A discloses a video diagnostic method and apparatus, which includes: obtaining a monitoring request, the monitoring request containing information about multicast video services; the monitoring request being used to request monitoring of the multicast video services; performing monitoring of the multicast video services based on the information about the multicast video services, and generating and storing monitoring logs, the monitoring logs including monitoring data of the multicast video services; and sending the monitoring logs to a video diagnostic server, the monitoring logs being used to determine the location of video faults based on the monitoring data.

[0006] However, in the process of implementing the inventive technical solution in the embodiments of this application, the inventors of this application discovered that the above-mentioned technology has at least the following technical problems:

[0007] In existing technologies, trend prediction techniques are used to improve prediction accuracy by reducing the precision of prediction. However, trend prediction is transformed into a classification prediction problem, which suffers from low data prediction accuracy. Summary of the Invention

[0008] This application provides a data security processing method based on alarm threshold triggering combined with MTD algorithm, which solves the problem of low data prediction accuracy in the prior art and improves the data prediction accuracy.

[0009] This application provides a data security processing method based on alarm threshold triggering combined with the MTD algorithm, including the following steps: S1, real-time alarm data set acquisition: real-time alarm data is obtained by monitoring the operation and maintenance system through real-time monitoring alarms, and the real-time alarm data is classified by alarm data monitoring indicators to obtain a real-time alarm data set; S2, operation and maintenance system abnormal alarm data capture: the acquired real-time alarm data set is compared with the actual value and dynamic threshold to capture the operation and maintenance system abnormal alarm data; S3, operation and maintenance system abnormal data processing: based on the abnormal type corresponding to the captured operation and maintenance system abnormal alarm data and the abnormal situation of the real-time alarm data of the operation and maintenance system at the next moment, the operation and maintenance system abnormal data processing is performed in combination with the MTD algorithm.

[0010] Furthermore, the alarm data monitoring indicators in S1 are obtained by analyzing historical alarm data using cluster analysis. The specific process is as follows: S11, constructing an alarm data clustering model: based on the fault types of the operation and maintenance system, an alarm data clustering model is constructed using the K-means clustering algorithm, where K represents the number of fault types in the operation and maintenance system; S12, obtaining alarm data monitoring indicators: the alarm data monitoring indicators are obtained by performing cluster analysis on historical alarm data through the alarm data clustering model.

[0011] Furthermore, the classification of real-time alarm data in S1 is achieved through a k-nearest neighbor (kNN) classification model constructed using the kNN classification algorithm. The specific process is as follows: After acquiring the real-time alarm data, a search is performed in the alarm data space. The distance between each historical alarm data point and the real-time alarm data in the alarm data space is calculated using a distance function to obtain the k nearest neighbor samples of the real-time alarm data and the categories to which these k nearest neighbor samples belong. Then, the probability that the real-time alarm data belongs to the category of the k nearest neighbor samples is calculated using a combination function to obtain the category to which the real-time alarm data belongs, thus achieving real-time alarm data classification. The value of k is determined by the alarm data type combined with a heuristic algorithm; the distance function is determined by a sample similarity measurement method in cluster analysis; and the combination function is determined based on the voting principle.

[0012] Furthermore, in S2, the abnormal alarm data of the operation and maintenance system is captured. The specific process is as follows: the real-time alarm data set is analyzed by the log server of the operation and maintenance system. For the alarm data monitoring indicators, the alarms with overlapping segment semantic results in the four major categories of data alarms are merged by the k-nearest neighbor classification model. The abnormal alarm data in the real-time alarm data is obtained by combining the results of the second-level analysis.

[0013] Furthermore, the log server performs a two-layer analysis of the acquired real-time alarm data set as follows: First, it analyzes the relationships between log service application data in the log service application database of the log server to obtain the core application service topology of the log server, and associates the core application topology with the network topology. Second, it obtains a topology data set from each service log of the log server. This topology data set, based on the core application service topology obtained in the first layer, records the monitoring data and operational health status between the log server and log service application data at different time dimensions. The core application service topology records the relationships between log service application data between different servers. The log service application data includes basic monitoring metrics for the database, middleware, and servers, where the basic server monitoring metrics are server CPU, memory, disk, and processes.

[0014] Furthermore, the dynamic threshold in S2 is set after the operation and maintenance system obtains accurate abnormal alarm data results, specifically as follows: the dynamic threshold includes a primary dynamic threshold and a secondary dynamic threshold; the primary dynamic threshold serves as the initial dynamic threshold for the next monitoring of abnormal fluctuations and is responsible for data fluctuation alarms; the secondary dynamic threshold is responsible for data fluctuation early warnings.

[0015] Furthermore, the process of setting the dynamic threshold is as follows: The dynamic thresholds of the nine most recent historical abnormal fluctuations are obtained and combined with the current abnormal fluctuation data to form an initial abnormal fluctuation threshold set; a non-repeating weighted average is calculated for all dynamic thresholds in the initial abnormal fluctuation threshold set to obtain an average threshold trend line; the data above and below the average threshold trend line are divided to form an initial primary dynamic threshold set and an initial secondary dynamic threshold set, where the initial primary dynamic threshold set consists of data above the trend line and the initial secondary dynamic threshold set consists of data below the trend line; abnormal diagnostic data from the historical abnormal fluctuation data is filtered out from the initial abnormal fluctuation threshold set to obtain an abnormal fluctuation threshold set; abnormal fluctuations and abnormal diagnoses are analyzed on the initial primary dynamic threshold set and the abnormal fluctuation threshold set to obtain the primary dynamic threshold; abnormal fluctuations and abnormal diagnoses are analyzed on the initial secondary dynamic threshold set and the abnormal fluctuation threshold set to obtain the secondary dynamic threshold.

[0016] Furthermore, the anomaly types in S3 include anomaly diagnosis and anomaly fluctuation, specifically as follows: the anomaly diagnosis refers to individual data in the alarm data; the anomaly fluctuation refers to the magnitude of change in the alarm data, and whether an anomaly fluctuation occurs is determined by the magnitude of multiple consecutive alarm data.

[0017] Furthermore, the specific process of processing abnormal data of the operation and maintenance system in S3 using the MTD algorithm is as follows: determine whether the real-time alarm data of the operation and maintenance system has an abnormal diagnosis. If no abnormal diagnosis occurs, continue to acquire the real-time alarm data at the next moment. If an abnormal diagnosis occurs, use the MTD algorithm to construct a fingerprint recognition model and immediately perform MTD preprocessing on the real-time alarm data. Then, determine whether the abnormal alarm has recovered by using the acquired real-time alarm data at the next moment. If the abnormal alarm has recovered, cancel the MTD processing. Otherwise, perform MTD processing on the alarm data and send it to the obfuscation area for obfuscation processing.

[0018] Furthermore, the obfuscation process involves obfuscating the acquired real-time alarm data with a probability of P0 using a fingerprint recognition model, where P0 ≥ P a P a The probability of data packet obfuscation during normal transmission.

[0019] One or more technical solutions provided in the embodiments of this application have at least the following technical effects or advantages:

[0020] 1. Real-time alarm data is obtained by monitoring the operation and maintenance system through real-time monitoring and alarms. An alarm data clustering model is constructed using the K-means clustering algorithm. The alarm data clustering model analyzes historical alarm data to obtain alarm data monitoring indicators. Based on the alarm data monitoring indicators, the real-time alarm data is classified using the k-nearest neighbor classification algorithm to obtain a real-time alarm data set. This achieves accurate classification of real-time alarm data, thereby improving the accuracy of data prediction and solving the problem of low data prediction accuracy in existing technologies.

[0021] 2. By setting dynamic thresholds based on accurate abnormal alarm data from the operation and maintenance system, abnormal alarm data in the real-time alarm data of the operation and maintenance system is monitored. The acquired real-time alarm data set is compared with the actual value and the dynamic threshold. The topology data set is obtained through two-level analysis of the real-time alarm data set by the log server of the operation and maintenance system. The real-time alarm data is then merged using the k-nearest neighbor classification algorithm. This achieves efficient acquisition of abnormal alarm data from the operation and maintenance system, thereby improving the efficiency of data prediction.

[0022] 3. By comparing the abnormal alarm data of the operation and maintenance system with historical alarm data, the anomaly type is determined. Based on the anomaly type, MTD preprocessing is performed, and the real-time alarm data of the operation and maintenance system at the next moment is acquired. Based on the anomaly recovery status of the operation and maintenance system, the MTD preprocessing is canceled or MTD processing is performed. The MTD processed data is sent to the obfuscation area and obfuscated with a certain probability through a fingerprint recognition model. This achieves secure processing of abnormal alarm data of the operation and maintenance system, thereby improving the accuracy of data prediction. Attached Figure Description

[0023] Figure 1 A flowchart of a data security processing method based on alarm threshold triggering combined with MTD algorithm provided in this application embodiment;

[0024] Figure 2 A flowchart for obtaining alarm data monitoring indicators provided in this application embodiment;

[0025] Figure 3 A flowchart illustrating the dynamic threshold setting process provided in this application embodiment. Detailed Implementation

[0026] This application provides a data security processing method based on alarm threshold triggering combined with the MTD algorithm, which solves the problem of low data prediction accuracy in the prior art. It obtains real-time alarm data by monitoring the operation and maintenance system through real-time alarm monitoring, and classifies the real-time alarm data into a real-time alarm data set by analyzing historical alarm data using a clustering model to obtain alarm data monitoring indicators. The real-time alarm data set is then used to capture abnormal alarm data of the operation and maintenance system by comparing the actual values ​​with dynamic thresholds. Finally, based on the abnormal type of the abnormal alarm data and the abnormal situation of the real-time alarm data of the operation and maintenance system at the next moment, the MTD algorithm is used to process the abnormal data of the operation and maintenance system, thereby improving the accuracy of data prediction.

[0027] The technical solution in this application embodiment aims to solve the problem of low data prediction accuracy mentioned above. The overall approach is as follows:

[0028] By classifying real-time alarm data of the operation and maintenance system through alarm data monitoring indicators, a corresponding set is obtained. Then, the actual value and dynamic threshold are compared to capture abnormal alarm data of the operation and maintenance system. Finally, the abnormal data is processed by the MTD algorithm according to the abnormal alarm data and the abnormal situation of the operation and maintenance system in the next moment, thereby improving the accuracy of data prediction.

[0029] To better understand the above technical solutions, the following will provide a detailed explanation of the technical solutions in conjunction with the accompanying drawings and specific implementation methods.

[0030] like Figure 1The diagram shows a flowchart of a data security processing method based on alarm threshold triggering combined with the MTD algorithm, provided in an embodiment of this application. The method includes the following steps: S1, real-time alarm data set acquisition: real-time alarm data is obtained by monitoring the operation and maintenance system through real-time monitoring alarms, and the real-time alarm data is classified by alarm data monitoring indicators to obtain a real-time alarm data set; S2, operation and maintenance system abnormal alarm data capture: the acquired real-time alarm data set is compared with the actual value and dynamic threshold to capture the operation and maintenance system abnormal alarm data; S3, operation and maintenance system abnormal data processing: based on the abnormal type corresponding to the captured operation and maintenance system abnormal alarm data and the abnormal situation of the real-time alarm data of the operation and maintenance system at the next moment, the operation and maintenance system abnormal data processing is performed in combination with the MTD algorithm.

[0031] In this embodiment, the main goal of the MTD algorithm is to increase the security of the system through dynamic changes; it also improves the accuracy of data prediction in the operation and maintenance system.

[0032] Furthermore, such as Figure 2 The diagram shows the flowchart for obtaining alarm data monitoring indicators according to an embodiment of this application. In S1, the alarm data monitoring indicators are obtained by analyzing historical alarm data using cluster analysis. The specific process is as follows: S11, constructing an alarm data clustering model: Based on the fault types of the operation and maintenance system, an alarm data clustering model is constructed using the K-means clustering algorithm, where K represents the types of faults in the operation and maintenance system; S12, obtaining alarm data monitoring indicators: The alarm data monitoring indicators are obtained by performing cluster analysis on historical alarm data through the alarm data clustering model.

[0033] In this embodiment, the K-means clustering algorithm is a commonly used unsupervised learning algorithm. Its main steps are initialization, randomly selecting K initial cluster centers, allocating data points, and updating the cluster centers until the cluster centers no longer change, thus obtaining the final clustering result. The alarm data monitoring metrics are latency, traffic volume, saturation, and errors. Latency is the time consumed from sending a data request to receiving a response. Traffic volume is the traffic of the currently monitored operation and maintenance system, i.e., the amount of requests per unit time, such as the number of HTTP requests. Saturation is the degree to which a service or resource has reached its limit, such as CPU utilization, memory utilization, disk utilization, and the number of connections to the cache database. Errors are the number or error rate of errors occurring in the current service. This provides a more standardized description of the operation and maintenance system's alarm data.

[0034] Furthermore, in S1, the classification of real-time alarm data is achieved through a k-nearest neighbor (kNN) classification model constructed using the kNN classification algorithm. The specific process is as follows: After acquiring the real-time alarm data, a search is performed in the alarm data space. The distance between each historical alarm data point and the real-time alarm data is calculated using a distance function to obtain the k nearest neighbor samples of the real-time alarm data and their respective categories. Then, a combination function is used to calculate the probability that the real-time alarm data belongs to the category of the k nearest neighbor samples, thus obtaining the category to which the real-time alarm data belongs, achieving real-time alarm data classification. The value of k is determined by the alarm data type combined with a heuristic algorithm; the distance function is determined by a sample similarity measurement method in cluster analysis; and the combination function is determined based on the voting principle.

[0035] In this embodiment, the k-nearest neighbor (kNN) classification algorithm is sensitive to noise. A large k value can reduce the impact of noise, but a large number of nearest neighbor samples may lead to classification errors, while a small k value may cause voting to fail or be affected by noise. The kNN classification algorithm only needs to calculate the distance between samples of adjacent classes to find the nearest samples of the real-time alarm data, because if the centers of two classes are far apart, samples in the corresponding classes are generally unlikely to be neighbors. Voting includes simple unweighted voting and weighted voting. In simple unweighted voting, each nearest neighbor sample has the same impact on the category to which the real-time alarm data belongs. By considering the k nearest neighbor samples x... i The real-time alarm data is categorized by its category count, and assigned to the category with the highest count. The corresponding formula is as follows: When x i ∈C j η(x) i ∈C j ) = 1, otherwise η(x) i ∈C j ) = 0, where η represents the counting function, C j Let j = 1, 2, 3, 4, and i = 1, 2, ..., k, where j is the category number of the nearest neighbor sample and i is the category number of the nearest neighbor sample. When the category counts are the same, a category is randomly selected from the real-time alarm data. Weighted voting is used to weight each count to obtain the category. Wherein, the weight ω i Generally defined as d(x,x i () represents the real-time alarm data x and its nearest neighbor sample x. i The distance; thus improving the accuracy of data prediction in the operation and maintenance system.

[0036] Furthermore, S2 captures abnormal alarm data from the operation and maintenance system. The specific process is as follows: The log server of the operation and maintenance system performs a two-layer analysis on the acquired real-time alarm data set: For the alarm data monitoring indicators, the k-nearest neighbor classification model is used to classify the alarms into four categories. The alarms with overlapping segment semantic results are merged and processed. The abnormal alarm data in the real-time alarm data is obtained by combining the results of the two-layer analysis.

[0037] In this embodiment, k-nearest neighbor (kNN) is a basic classification and regression method; the four main categories of data are latency data, traffic data, saturation data, and error data; and it enables more accurate capture of abnormal alarm data in real-time alarm data in the operation and maintenance system.

[0038] Furthermore, the log server performs a two-layer analysis of the acquired real-time alarm data set as follows: First, it analyzes the relationships between log service application data in the log service application database of the log server to obtain the core application service topology of the log server, and associates the core application topology with the network topology. Second, it obtains a topology data set from each service log of the log server. Based on the core application service topology obtained in the first layer, the topology data set records the monitoring data and operational health status between the log server and log service application data at different time dimensions. The core application service topology records the relationships between log service application data between different servers. The log service application data consists of basic monitoring metrics for the database, middleware, and servers, with the basic server monitoring metrics being server CPU, memory, disk, and processes.

[0039] In this embodiment, the purpose of the log server performing Layer 2 analysis is to prevent the daily log data volume from reaching 10TB or more in large systems providing global services. Layer 2 analysis plays an important role in fault diagnosis, security monitoring, business optimization, and application tuning, thereby improving the data prediction security of the operation and maintenance system.

[0040] Furthermore, the dynamic thresholds in S2 are set after the operation and maintenance system obtains accurate abnormal alarm data results, as follows: The dynamic thresholds include primary dynamic thresholds and secondary dynamic thresholds; the primary dynamic threshold serves as the initial dynamic threshold for the next monitoring of abnormal fluctuations and is responsible for data fluctuation alarms; the secondary dynamic threshold is responsible for data fluctuation warnings.

[0041] In this embodiment, the primary dynamic threshold is a threshold strategy that adaptively adjusts based on real-time data and system status. It dynamically adjusts the threshold value based on the current environment and context information to monitor and make decisions according to the actual situation. Its advantage lies in its ability to adapt to different data and environmental changes. The secondary dynamic threshold introduces a secondary adjustment mechanism based on the primary dynamic threshold. It sets an additional restriction condition based on the current threat level or special circumstances, and is usually used to handle temporary or sudden situations. This improves the performance and accuracy of the operation and maintenance system under different workloads, and enhances the efficiency and real-time performance of alarm data processing in the operation and maintenance system.

[0042] Furthermore, such as Figure 3 The diagram shows a flowchart of the dynamic threshold setting process provided in this application embodiment. The dynamic threshold setting process is as follows: The dynamic thresholds of the nine most recent historical abnormal fluctuations are obtained and combined with the current abnormal fluctuation data to form an initial abnormal fluctuation threshold set; a non-repeating weighted average is calculated for all dynamic thresholds in the initial abnormal fluctuation threshold set to obtain an average threshold trend line; the data above and below the average threshold trend line are divided to form an initial primary dynamic threshold set and an initial secondary dynamic threshold set, where the initial primary dynamic threshold set consists of data on the trend line and the initial secondary dynamic threshold set consists of data below the trend line; abnormal diagnostic data from the historical abnormal fluctuation data is filtered out from the initial abnormal fluctuation threshold set to obtain an abnormal fluctuation threshold set; abnormal fluctuations and abnormal diagnoses are analyzed on the initial primary dynamic threshold set and the abnormal fluctuation threshold set to obtain the primary dynamic threshold; abnormal fluctuations and abnormal diagnoses are analyzed on the initial secondary dynamic threshold set and the abnormal fluctuation threshold set to obtain the secondary dynamic threshold.

[0043] In this embodiment, it is assumed that in the initial set of abnormal fluctuation thresholds, there are 6 instances above the trend line, recorded as 60%, and 4 instances below the trend line, recorded as 40%. This means that the probability of raising the abnormal fluctuation dynamic threshold in the next instance is 60%, and the probability of lowering the abnormal fluctuation dynamic threshold in the next instance is 40%. The primary dynamic threshold is the trend line that makes the probability of raising the abnormal fluctuation dynamic threshold in the next instance 10%, and the secondary dynamic threshold is the trend line that makes the probability of lowering the abnormal fluctuation dynamic threshold in the next instance 10%. This achieves an improvement in the data prediction efficiency of the operation and maintenance system.

[0044] Furthermore, the anomaly types in S3 include anomaly diagnosis and anomaly fluctuation, as follows: anomaly diagnosis refers to individual data in the alarm data; anomaly fluctuation refers to the magnitude of changes in alarm data, which is determined by the magnitude of multiple consecutive alarm data.

[0045] In this embodiment, anomaly diagnosis identifies individual data points that differ from the majority of values. As the definition of anomaly suggests, the number of anomalies is always very small compared to the number of normal values, and they are often discontinuous over time. There is no absolute relationship between abnormal fluctuations and the differences between the abnormal values ​​identified by anomaly diagnosis and the normal values. Therefore, it is not possible to determine whether it is an abnormal fluctuation or an abnormal value based on the magnitude of a single value. This improves the efficiency of processing abnormal data in the operation and maintenance system.

[0046] Furthermore, the specific process of handling abnormal data in the operation and maintenance system using the MTD algorithm in S3 is as follows: It is determined whether the real-time alarm data of the operation and maintenance system has an abnormal diagnosis. If no abnormal diagnosis occurs, the real-time alarm data of the next moment is acquired. If an abnormal diagnosis occurs, the MTD algorithm is used to construct a fingerprint recognition model and the real-time alarm data is immediately preprocessed using MTD. The system then determines whether the abnormal alarm has recovered based on the acquired real-time alarm data of the next moment. If the abnormal alarm has recovered, the MTD processing is canceled; otherwise, the alarm data is processed using MTD and then sent to the obfuscation area for obfuscation.

[0047] In this embodiment, MTD preprocessing is the first stage of the MTD algorithm. The main steps are randomization configuration, virtualization, and randomization of protocols and topologies to increase the attacker's attack cost and reduce the success rate of the attack, thereby improving system security. MTD processing is the second stage of the MTD algorithm. Specific processing methods may include real-time monitoring and detection, proactive response and dynamic adjustment, and self-adaptation and self-repair. The purpose is to dynamically adjust the system and network environment based on real-time security intelligence and threat situations to ensure system security and continuity. This improves the data transmission security of the operation and maintenance system.

[0048] Furthermore, the obfuscation process involves using a fingerprint recognition model to obfuscate the acquired real-time alarm data with a probability of P0, where P0 ≥ P a P a The probability of data packet obfuscation during normal transmission.

[0049] In this embodiment, fingerprint recognition models are typically used for authentication and access control. For any data packet sent to the server, there is a P... a The probability of obfuscating the data packet is calculated by the probability of sending n data packets. Ignoring other network mechanisms, the probability P(all sent to the target host) of all data packets reaching the target host satisfies P(all sent to the target host) = (1-P a ) nHere, n is the number of data packets sent. Obfuscation is used to send a portion of the data packets to the target host and another portion to the obfuscated area. To obtain accurate fingerprint information from the target host, the attacker needs to receive a certain number of response data packets from the target host. Assuming the hacker sends n data packets during a single host operating system and web application fingerprinting operation, to obtain accurate results, the hacker allows a maximum of m data packets to be obfuscated. The probability of the hacker obtaining accurate results satisfies... Where P min This represents the minimum probability that a data packet will be transmitted normally (with fewer than m obfuscated packets) when a hacker identifies fingerprint information. Only when the probability of a normally transmitted data packet is greater than this probability can the attacker accurately identify the correct fingerprint information of the target host; thus improving the data prediction security of the operation and maintenance system. Here, k represents the k-th data packet.

[0050] The technical solutions described in the above embodiments of this application have at least the following technical effects or advantages: Compared with the IPTVCDN user playback log reporting method and system disclosed in CN114827126A, the embodiments of this application obtain real-time alarm data by monitoring the operation and maintenance system through real-time monitoring alarms, construct an alarm data clustering model using the K-means clustering algorithm, obtain alarm data monitoring indicators by analyzing historical alarm data using the alarm data clustering model, and classify the real-time alarm data according to the alarm data monitoring indicators using the k-nearest neighbor classification algorithm to obtain a real-time alarm data set, thereby achieving accurate classification of real-time alarm data, and thus realizing... This application improves the accuracy of data prediction. Compared to the video diagnostic method and device disclosed in the invention patent with publication number CN112653887A, this application embodiment sets a dynamic threshold based on the accurate abnormal alarm data of the operation and maintenance system to monitor abnormal alarm data in the real-time alarm data of the operation and maintenance system. The acquired real-time alarm data set is compared with the actual value and the dynamic threshold. The topological data set is obtained through two-layer analysis of the real-time alarm data set by the log server of the operation and maintenance system. The real-time alarm data is then merged using the k-nearest neighbor classification algorithm. This achieves efficient acquisition of abnormal alarm data from the operation and maintenance system, thereby improving the efficiency of data prediction.

[0051] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0052] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0053] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0054] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0055] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention.

[0056] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A data security processing method based on alarm threshold triggering combined with MTD algorithm, characterized in that, Includes the following steps: S1, Real-time alarm data set acquisition: Real-time alarm data is obtained by monitoring the operation and maintenance system through real-time monitoring alarms, and the real-time alarm data is classified by alarm data monitoring indicators to obtain a real-time alarm data set; S2, Capture of abnormal alarm data in operation and maintenance system: The real alarm data set is compared with the actual value and dynamic threshold to capture abnormal alarm data in operation and maintenance system; S3, Operation and Maintenance System Abnormal Data Processing: Based on the abnormal type corresponding to the captured abnormal alarm data of the operation and maintenance system and the abnormal situation of the real-time alarm data of the operation and maintenance system at the next moment, the abnormal data of the operation and maintenance system is processed in combination with the MTD algorithm. The dynamic threshold in S2 is set after the operation and maintenance system obtains accurate abnormal alarm data, as follows: The dynamic threshold includes a primary dynamic threshold and a secondary dynamic threshold; The main dynamic threshold is used as the initial dynamic threshold for the next monitoring of abnormal fluctuations and is responsible for data fluctuation alarms. The aforementioned dynamic threshold is responsible for early warning of data fluctuations; The process for setting the dynamic threshold is as follows: Obtain the dynamic thresholds for the nine most recent historical abnormal fluctuations and combine them with the current abnormal fluctuation data to form an initial threshold set for abnormal fluctuations; A non-repeating weighted average is calculated for all dynamic thresholds in the initial threshold set of abnormal fluctuations to obtain the average threshold trend line; The data above and below the average threshold trend line are divided into an initial primary dynamic threshold set and an initial secondary dynamic threshold set. The initial primary dynamic threshold set consists of the data above the trend line, and the initial secondary dynamic threshold set consists of the data below the trend line. The abnormal diagnostic data in the historical abnormal fluctuation data is filtered out from the initial threshold set of abnormal fluctuations to obtain the abnormal fluctuation threshold set; Analyze abnormal fluctuations and diagnose abnormalities by analyzing the initial set of active dynamic thresholds and the set of abnormal fluctuation thresholds, and obtain the active dynamic thresholds; The initial set of sub-dynamic thresholds and the set of abnormal fluctuation thresholds are analyzed to identify abnormal fluctuations and diagnose abnormalities, thereby obtaining the sub-dynamic thresholds.

2. The data security processing method based on alarm threshold triggering combined with MTD algorithm as described in claim 1, characterized in that, The alarm data monitoring metrics in S1 are obtained by analyzing historical alarm data using cluster analysis. The specific process is as follows: S11, Construct an alarm data clustering model: Based on the fault types of the operation and maintenance system, use the K-means clustering algorithm to construct an alarm data clustering model, where K represents the number of fault types in the operation and maintenance system; S12, Obtain alarm data monitoring indicators: Perform cluster analysis on historical alarm data using an alarm data clustering model to obtain alarm data monitoring indicators.

3. The data security processing method based on alarm threshold triggering combined with MTD algorithm as described in claim 1, characterized in that, The classification of real-time alarm data in S1 is achieved through a k-nearest neighbor classification model constructed using the k-nearest neighbor classification algorithm. The specific process is as follows: After acquiring real-time alarm data, a search is performed in the alarm data space. The distance between each historical alarm data and the real-time alarm data in the alarm data space is calculated using a distance function to obtain the k nearest neighbor samples of the real-time alarm data and the category to which the k nearest neighbor samples belong. Then, the probability of the real-time alarm data belonging to the category to which the k nearest neighbor samples belong is calculated using a combination function to obtain the category to which the real-time alarm data belongs, thus realizing the classification of real-time alarm data. The value of k is determined by combining the alarm data type with a heuristic algorithm; The distance function is determined by the sample similarity measurement method in cluster analysis; The combined function is determined based on the voting principle.

4. The data security processing method based on alarm threshold triggering combined with MTD algorithm as described in claim 3, characterized in that, The process of capturing abnormal alarm data from the operation and maintenance system in S2 is as follows: The real-time alarm data set acquired through the operation and maintenance system's log server is analyzed in a second-level manner: For alarm data monitoring metrics, alarms with overlapping segment semantic results in four major categories of alarm data are merged using the k-nearest neighbor classification model, and abnormal alarm data in real-time alarm data are obtained by combining the results of two-layer analysis.

5. The data security processing method based on alarm threshold triggering combined with MTD algorithm as described in claim 4, characterized in that, The process of the log server performing two-level analysis on the acquired real-time alarm data set is as follows: The first layer analyzes the relationship between log service application data in the log service application database of the log server to obtain the core application service topology of the log server, and associates the core application topology with the network topology. The second layer obtains a topology data set from each service log of the log server. The topology data set is based on the core application service topology obtained in the first layer and records the monitoring data and operational health status between the log server and the log service application data at different time dimensions. The core application service topology records the relationship between log service application data between different servers; The log service application data includes basic monitoring metrics for the database, middleware, and servers, among which the basic server monitoring metrics are server CPU, memory, disk, and processes.

6. The data security processing method based on alarm threshold triggering combined with MTD algorithm as described in claim 1, characterized in that, The abnormality types in S3 include abnormal diagnosis and abnormal fluctuations, as detailed below: The anomaly diagnosis refers to individual data points within the alarm data; The abnormal fluctuation refers to the magnitude of change in alarm data. The presence of abnormal fluctuations is determined by the magnitude of multiple consecutive alarm data.

7. The data security processing method based on alarm threshold triggering combined with MTD algorithm as described in claim 1, characterized in that, The specific process of handling abnormal data in the operation and maintenance system using the MTD algorithm in S3 is as follows: The system determines whether any abnormal diagnoses have occurred in the real-time alarm data of the operation and maintenance system. If no abnormal diagnoses have occurred, it continues to acquire the real-time alarm data of the next moment. If an abnormal diagnose has occurred, it uses the MTD algorithm to construct a fingerprint recognition model and immediately performs MTD preprocessing on the real-time alarm data. It then determines whether the abnormal alarm has recovered based on the acquired real-time alarm data of the next moment. If the abnormal alarm has recovered, the MTD processing is canceled; otherwise, the alarm data is processed by MTD and then sent to the obfuscation area for obfuscation.

8. The data security processing method based on alarm threshold triggering combined with MTD algorithm as described in claim 7, characterized in that: The obfuscation process involves using a fingerprint recognition model to process the acquired real-time alarm data. The probabilities are obfuscated, where , The probability of data packet obfuscation during normal transmission.

Images