An abnormal operation monitoring method, device, equipment and storage medium

Abstract

The application discloses an abnormal operation monitoring method and device, equipment and a storage medium, which are applied to an application system provider, relate to the technical field of computers, and include the following steps: determining the association relationship between each on-site staff and on-site operation permission, authorized operation assets and on-site operation scenarios based on operation and maintenance information of a target application set by an application system user, and collecting abnormal operation behaviors; generating an abnormal behavior monitoring model according to the association relationship and the abnormal operation behaviors, and sending the abnormal behavior monitoring model to an ELK system of the application system user, so that the application system user uses the abnormal behavior monitoring model to monitor the behaviors of each on-site staff; and obtaining on-site behavior alarm information sent by the application system user through a preset offline data sending mode, and determining abnormal operation information based on the on-site behavior alarm information. In this way, the safety of IT on-site operation and maintenance services can be improved.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a method, apparatus, device, and storage medium for monitoring abnormal operations. Background Technology

[0002] For IT (Internet Technology) vendors targeting specific industries, they typically provide standardized application systems to customers at all levels within the industry and deploy on-site IT personnel to different customer sites to provide upgrades, improvements, and maintenance services. This means that these on-site personnel may possess certain customer IT privileges, access to customer IT assets within their authorized scope, and access to customer business or operational data subject to confidentiality constraints. As required, IT vendors must regulate, constrain, and monitor the behavior of their on-site personnel in fulfilling their supply chain security obligations to prevent security-related breaches of trust. Currently, the main internal control practices that IT vendors can implement are: relying on on-site teams to remind on-site personnel of compliant behavior through security training and personnel management measures; and relying on customer security technologies to control, monitor, and audit the behavior of on-site personnel, as they cannot deploy other proactive and controlled security technologies on the customer side. Basic information about IT on-site personnel, customer arrival and departure information, job responsibilities, and customer-side operational process work order information are scattered across different systems such as EHR (Electronic Human Resource), project management, service desk systems, and deployment systems. These systems are managed and monitored separately by different teams, including human resources, project management, and operations. However, due to security policies such as internal and external network isolation for industry customers, the operational activities of IT on-site personnel are typically conducted in a closed environment within the customer's network. From the IT vendor's perspective, the available security technologies for internal control of security-related breaches are limited, making it impossible to apply a unified management strategy to all IT on-site personnel at customer sites, or to promptly and effectively obtain information on abnormal operational behaviors of IT on-site personnel. Security factors are not adequately considered during IT on-site operations services, resulting in poor implementation of control points for preventing security-related breaches. Furthermore, due to the customer's internal and external network isolation requirements, data on IT on-site personnel's behavior cannot be transmitted back to the IT vendor via the network, preventing the IT vendor from conducting unified real-time analysis and handling of IT on-site personnel's behavior. Data on various operational activities of IT on-site personnel at the customer's site is scattered across the IT service desk, CMDB (Configuration Management Database), and customer-side host logs. This lack of aggregation and visualization, tailored to individual personnel, hinders the tracing of security breaches and the prediction of on-site personnel behavior. Therefore, improving the monitoring of on-site personnel's operational activities to enhance the security of on-site IT operations and maintenance services is a crucial issue that needs to be addressed. Summary of the Invention

[0003] In view of this, the purpose of this invention is to provide a method, apparatus, device, and storage medium for monitoring abnormal operations, so as to better monitor the operational behavior of on-site personnel and thereby improve the security of IT on-site operation and maintenance services. The specific solution is as follows:

[0004] Firstly, this application discloses an abnormal operation monitoring method, applied to an application system provider, including:

[0005] Based on the operation and maintenance information set by the application system user for the target application, determine the association between each on-site personnel and on-site operation and maintenance permissions, authorized operation and maintenance assets and on-site operation and maintenance scenarios, and identify on-site operation behaviors based on the on-site operation and maintenance scenarios to collect abnormal operation behaviors.

[0006] An abnormal behavior monitoring model is generated based on the association and the abnormal operation behavior, and the abnormal behavior monitoring model is sent to the ELK system of the application system user so that the application system user can use the abnormal behavior monitoring model to monitor the behavior of each of the on-site personnel.

[0007] The system obtains on-site behavior alarm information sent by the user of the application system through a preset offline data transmission method, and determines abnormal operation information based on the on-site behavior alarm information.

[0008] Optionally, the determination of the association between each on-site personnel and their on-site maintenance permissions, authorized maintenance assets, and on-site maintenance scenarios based on the maintenance information set by the application system user for the target application includes:

[0009] On-site personnel apply for maintenance permissions through the application system user's default service desk to obtain on-site maintenance permissions.

[0010] Obtain the authorized operation and maintenance assets of the application system user, and determine the association between each on-site personnel and the on-site operation and maintenance permissions, the authorized operation and maintenance assets, and the on-site operation and maintenance scenario.

[0011] Optionally, after determining the association between each on-site personnel and their on-site maintenance permissions, authorized maintenance assets, and on-site maintenance scenarios based on the maintenance information set by the application system user for the target application, the method further includes:

[0012] The aforementioned relationships are organized, and the on-site personnel, their corresponding on-site operation and maintenance permissions, authorized operation and maintenance assets, and on-site operation and maintenance scenarios are stored in the local on-site personnel security archive.

[0013] Optionally, the step of identifying on-site operational behaviors based on the on-site operation and maintenance scenario to collect abnormal operational behaviors includes:

[0014] Based on the on-site maintenance scenario, on-site maintenance commands and data operation instructions are identified to determine abnormal on-site maintenance commands and abnormal data operation instructions.

[0015] Optionally, generating the abnormal behavior monitoring model based on the association and the abnormal operation behavior includes:

[0016] An abnormal behavior database is generated based on the aforementioned relationships and abnormal operation behaviors, and a preset model is trained based on the data in the abnormal behavior database to obtain an abnormal behavior monitoring model.

[0017] Optionally, after generating the abnormal behavior monitoring model based on the association and the abnormal operation behavior, the method further includes:

[0018] Based on the abnormal operation behavior, an operation reminder icon is set in the abnormal behavior monitoring model so that when the on-site personnel exhibit abnormal operation behavior, the application system user can remind the on-site personnel of the operation through the operation reminder icon.

[0019] Optionally, the step of obtaining on-site behavior alarm information sent by the application system user through a preset offline data transmission method, and determining abnormal operation information based on the on-site behavior alarm information, includes:

[0020] The system obtains on-site behavior alarm information sent by the user of the application system through the preset text recognition function / QR code of the preset service desk, and determines abnormal operation information based on the on-site behavior alarm information.

[0021] Secondly, this application discloses an abnormal operation monitoring device, applied to an application system provider, comprising:

[0022] The information identification module is used to determine the relationship between each on-site personnel and on-site operation and maintenance permissions, authorized operation and maintenance assets and on-site operation and maintenance scenarios based on the operation and maintenance information set by the application system user for the target application, and to identify on-site operation behaviors based on the on-site operation and maintenance scenarios in order to collect abnormal operation behaviors.

[0023] The model generation module is used to generate an abnormal behavior monitoring model based on the association relationship and the abnormal operation behavior, and send the abnormal behavior monitoring model to the ELK system of the application system user so that the application system user can use the abnormal behavior monitoring model to monitor the behavior of each of the on-site personnel.

[0024] The operation information confirmation module is used to obtain on-site behavior alarm information sent by the user of the application system through a preset offline data transmission method, and to determine abnormal operation information based on the on-site behavior alarm information.

[0025] Thirdly, this application discloses an electronic device, including:

[0026] Memory, used to store computer programs;

[0027] A processor for executing the computer program to implement the aforementioned abnormal operation monitoring method.

[0028] Fourthly, this application discloses a computer-readable storage medium for storing a computer program, which, when executed by a processor, implements the aforementioned abnormal operation monitoring method.

[0029] As can be seen, in this application, the relationship between on-site personnel and their on-site operation and maintenance permissions, authorized operation and maintenance assets, and on-site operation and maintenance scenarios is determined based on the operation and maintenance information set by the application system user for the target application. On-site operational behaviors are then identified based on these on-site operation and maintenance scenarios to collect abnormal operational behaviors. An abnormal behavior monitoring model is generated based on the relationship and the abnormal operational behaviors, and this model is sent to the application system user's ELK system so that the application system user can use the abnormal behavior monitoring model to monitor the behavior of each on-site personnel. On-site behavior alarm information sent by the application system user through a preset offline data transmission method is obtained, and abnormal operation information is determined based on this alarm information. In this way, classifying IT on-site operation and maintenance services according to security factors and establishing relationships with on-site personnel helps to better monitor abnormal behaviors of on-site personnel, thereby improving the security of IT on-site operation and maintenance services. Attached Figure Description

[0030] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0031] Figure 1 This is a flowchart of an abnormal operation monitoring method disclosed in this application;

[0032] Figure 2 This application discloses a flowchart of a specific abnormal operation monitoring method.

[0033] Figure 3 This is a schematic diagram of the structure of an abnormal operation monitoring device disclosed in this application;

[0034] Figure 4 This is a structural diagram of an electronic device disclosed in this application. Detailed Implementation

[0035] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0036] For IT vendors targeting specific industries, they typically provide standardized application systems to customers at all levels within the industry and dispatch on-site IT personnel to different customer sites to provide upgrades, improvements, and operation and maintenance services. This application will specifically introduce an abnormal operation monitoring method that can help application system users better monitor the operational behavior of on-site personnel and help application system providers to manage on-site personnel in a unified manner.

[0037] See Figure 1 As shown in the figure, this application discloses an abnormal operation monitoring method, applied to an application system provider, including:

[0038] Step S11: Based on the operation and maintenance information set by the application system user for the target application, determine the association between each on-site personnel and on-site operation and maintenance permissions, authorized operation and maintenance assets and on-site operation and maintenance scenarios, and identify on-site operation behaviors based on the on-site operation and maintenance scenarios to collect abnormal operation behaviors.

[0039] In this embodiment, determining the association between on-site personnel and their on-site maintenance permissions, authorized maintenance assets, and on-site maintenance scenarios based on the maintenance information set by the application system user for the target application includes: applying for maintenance permissions for each on-site personnel through the application system user's preset service desk to obtain on-site maintenance permissions; obtaining the authorized maintenance assets of the application system user, and determining the association between each on-site personnel and their on-site maintenance permissions, authorized maintenance assets, and on-site maintenance scenarios. That is, a baseline for IT on-site personnel permissions is designed, and the minimum application and allocation of customer maintenance permissions required by IT on-site personnel is completed through the application system user's preset service desk, ensuring that everyone only has general maintenance permissions. Then, a maintainable customer IT asset list is established through CMDB, and high-protection-value customer IT assets are identified based on relevant elements and tagged. Finally, from the perspective of the on-site personnel, the association between their responsible maintenance scenarios, their customer maintenance permissions, and the customer IT assets they can operate is established, providing a one-person display. In this embodiment, after determining the association between each on-site personnel and their on-site maintenance permissions, authorized maintenance assets, and on-site maintenance scenarios based on the maintenance information set by the application system user for the target application, the method further includes: organizing the association relationships and storing each on-site personnel and their corresponding on-site maintenance permissions, authorized maintenance assets, and on-site maintenance scenarios in a local on-site personnel security archive. This facilitates the application system provider in obtaining subsequent alarm information from the application system user and allows for the rapid summarization of on-site personnel abnormal behavior handling work orders from the security archive. In this embodiment, the step of identifying on-site operational behaviors based on the on-site maintenance scenario to collect abnormal operational behaviors includes: identifying on-site maintenance commands and data operation instructions based on the on-site maintenance scenario to determine abnormal on-site maintenance commands and abnormal data operation instructions. That is, based on the maintenance scenario, identifying potentially high-risk maintenance commands and data operation behaviors to determine abnormal on-site maintenance commands and abnormal data operation instructions.

[0040] Step S12: Generate an abnormal behavior monitoring model based on the association and the abnormal operation behavior, and send the abnormal behavior monitoring model to the ELK system of the application system user so that the application system user can use the abnormal behavior monitoring model to monitor the behavior of each of the on-site personnel.

[0041] In this embodiment, generating an abnormal behavior monitoring model based on the correlation and the abnormal operation behavior includes: generating an abnormal behavior database based on the correlation and the abnormal operation behavior, and training a preset model based on the data in the abnormal behavior database to obtain the abnormal behavior monitoring model. Specifically, the abnormal behavior database is generated from the correlation and the abnormal operation behavior, and then deployed on the client-side ELK (Elasticsearch, Logstash, and Kibana, an acronym for three open-source software products) system. Then, an abnormal operation and maintenance behavior model of IT on-site personnel is injected into the ELK system. After generating the abnormal behavior monitoring model based on the correlation and the abnormal operation behavior, the method further includes: setting operation reminder flags in the abnormal behavior monitoring model based on the abnormal operation behavior, so that when on-site personnel exhibit abnormal operation behavior, the application system user can remind the on-site personnel of the operation through the operation reminder flags. That is, when it is detected that in the operation and maintenance scenario and script preparation where high-risk commands are not required, the on-site personnel mistakenly use high-risk commands due to unfamiliarity with internal control requirements, the operation reminder icon can be used to remind the on-site personnel that the plan is non-compliant and reduce the probability of high-risk operations by the on-site personnel. The operation reminder icon includes, but is not limited to, process checkpoints and behavior baselines.

[0042] Step S13: Obtain the on-site behavior alarm information sent by the user of the application system through a preset offline data transmission method, and determine the abnormal operation information based on the on-site behavior alarm information.

[0043] In this embodiment, obtaining on-site behavior alarm information sent by the application system user through a preset offline data transmission method, and determining abnormal operation information based on the on-site behavior alarm information, includes: obtaining on-site behavior alarm information sent by the application system user through a preset text recognition function / QR code of a preset service desk, and determining abnormal operation information based on the on-site behavior alarm information. Then, the collected behavior data is analyzed and alarms are generated, with high-level alarm information displayed as QR codes or images. Then, the application system provider centrally collects the high-level alarm information from the IT service provider via the QR code / OCR (Optical Character Recognition) recognition function of the IT service desk in an offline, network-free manner, triggering an abnormal behavior handling work order from the IT on-site personnel. Then, the application system provider updates the abnormal behavior database based on the abnormal behavior handling work order.

[0044] As can be seen, in this embodiment, the association between each on-site personnel and their on-site operation and maintenance permissions, authorized operation and maintenance assets, and on-site operation and maintenance scenarios is determined based on the operation and maintenance information set by the application system user for the target application. On-site operational behaviors are then identified based on these on-site operation and maintenance scenarios to collect abnormal operational behaviors. An abnormal behavior monitoring model is generated based on the association and the abnormal operational behaviors, and this model is sent to the application system user's ELK system so that the application system user can use the abnormal behavior monitoring model to monitor the behavior of each on-site personnel. On-site behavior alarm information sent by the application system user through a preset offline data transmission method is obtained, and abnormal operation information is determined based on this alarm information. In this way, classifying IT on-site operation and maintenance services according to security factors and establishing associations with on-site personnel helps to better monitor abnormal behaviors of on-site personnel, thereby improving the security of IT on-site operation and maintenance services.

[0045] See Figure 2As shown in the illustration, this application discloses a specific method for monitoring abnormal operations, applied to an application system provider. First, the application system provider designs an IT on-site personnel permission baseline, completing the minimum application and allocation of customer maintenance permissions required by IT on-site personnel through the IT service desk process, ensuring that everyone only has general maintenance permissions. Then, based on the application system developed by the IT vendor, a maintainable customer IT asset list is established through a CMDB, and high-protection-value customer IT assets are identified based on relevant elements and tagged. Next, according to the individual IT on-site personnel, the relationship between their responsible maintenance scenarios, their customer maintenance permissions, and the customer IT assets they can operate is established, presented in a one-person format. Furthermore, based on the IT on-site maintenance scenarios, high-risk maintenance commands that may be used and data operation behaviors that may be involved are identified. After designing IT on-site maintenance operation baselines and security-related breach of trust control points, abnormal maintenance behavior modeling of IT on-site personnel is carried out according to the dimensions of personnel, permissions, assets, and behaviors. During specific maintenance operations, it is necessary to determine whether to embed security control points and the maintenance operation behavior baseline based on the IT maintenance scenario and security factors. In addition, during specific operation and maintenance (O&M) processes, for IT O&M scenarios requiring high-level privileges, a special application is initiated through the IT service desk to obtain secondary authorization from the system administrator. For high-risk IT O&M scenarios involving high-value assets, requiring the execution of high-risk O&M commands, or requiring data operations, process checkpoints are added, and baseline reminders for O&M operation behavior are embedded. Other IT O&M scenarios are incorporated into general operation processes, using general privileges to perform basic operations. The behavioral data of these three types of operations are collected into the IT vendor's ELK system deployed on the customer's side. An abnormal O&M behavior model of IT on-site personnel is infused into the ELK system, and the collected behavioral data is used for analysis and alerting. High-level alert information is displayed as QR codes or images. High-level alert information is centrally collected from the IT service vendor offline without network connection using the QR code / OCR recognition function of the IT service desk, triggering an abnormal behavior handling work order for IT on-site personnel. The abnormal behavior database of IT on-site personnel is enriched according to human dimensions to construct an IT on-site personnel profile, and then behavioral prediction is performed on the on-site personnel's operational behavior. Here, the customer refers to the user of the application system.

[0046] As can be seen, this embodiment, by drawing on the concept of "security shift left," conducts security requirements analysis and design during the planning, design, and execution of IT on-site services. It designs baseline permissions and operational procedures for IT on-site personnel and embeds internal security controls to prevent security-related breaches of trust. With customer authorization, behavioral data of IT on-site personnel within the scope of IT services is collected at the customer's site. A lightweight model of abnormal operational behavior by IT on-site personnel is used to visualize the execution of high-risk operational commands and high-risk data operation commands that may lead to security-related breaches of trust. This enables IT on-site behavior analysis and alerts, and high-level alert information from the customer's site is transmitted offline using technologies such as QR code / OCR recognition. A personalized IT on-site personnel profile is constructed, linking their authorized operational scenarios, permissions, and customer-side IT assets to create an IT on-site personnel profile and predict their behavior. IT on-site operational services are categorized according to security factors, and corresponding security control measures are embedded into the IT service process, thereby improving the security of IT on-site operational services. This approach enhances the visibility of IT on-site personnel behavior by establishing a lightweight mechanism for identifying abnormal behavior on the customer's side. Furthermore, it enables the compliant transmission of high-level alarm information from the customer's site to the IT vendor even without a network connection, improving the vendor's control over the IT on-site environment. In addition, the creation of a single-person IT on-site personnel security profile, including data on permissions and behavior, allows for both post-incident tracing and pre-incident prediction.

[0047] refer to Figure 3 The present application also discloses an abnormal operation monitoring device, which is applied to an application system provider, including:

[0048] The information identification module 11 is used to determine the relationship between each on-site personnel and on-site operation and maintenance permissions, authorized operation and maintenance assets and on-site operation and maintenance scenarios based on the operation and maintenance information set by the application system user for the target application, and to identify on-site operation behaviors based on the on-site operation and maintenance scenarios in order to collect abnormal operation behaviors.

[0049] The model generation module 12 is used to generate an abnormal behavior monitoring model based on the association relationship and the abnormal operation behavior, and send the abnormal behavior monitoring model to the ELK system of the application system user so that the application system user can use the abnormal behavior monitoring model to monitor the behavior of each of the on-site personnel.

[0050] The operation information confirmation module 13 is used to obtain on-site behavior alarm information sent by the user of the application system through a preset offline data transmission method, and to determine abnormal operation information based on the on-site behavior alarm information.

[0051] As can be seen, in this embodiment, the association between each on-site personnel and their on-site operation and maintenance permissions, authorized operation and maintenance assets, and on-site operation and maintenance scenarios is determined based on the operation and maintenance information set by the application system user for the target application. On-site operational behaviors are then identified based on these on-site operation and maintenance scenarios to collect abnormal operational behaviors. An abnormal behavior monitoring model is generated based on the association and the abnormal operational behaviors, and this model is sent to the application system user's ELK system so that the application system user can use the abnormal behavior monitoring model to monitor the behavior of each on-site personnel. On-site behavior alarm information sent by the application system user through a preset offline data transmission method is obtained, and abnormal operation information is determined based on this alarm information. In this way, classifying IT on-site operation and maintenance services according to security factors and establishing associations with on-site personnel helps to better monitor abnormal behaviors of on-site personnel, thereby improving the security of IT on-site operation and maintenance services.

[0052] In some specific embodiments, the information recognition module 11 may specifically include:

[0053] The permission application unit is used to apply for on-site operation and maintenance permissions for each on-site personnel through the application system user's preset service desk in order to obtain on-site operation and maintenance permissions;

[0054] The association determination unit is used to obtain the authorized operation and maintenance assets of the application system user and determine the association between each on-site personnel and the on-site operation and maintenance permissions, the authorized operation and maintenance assets and the on-site operation and maintenance scenario.

[0055] In some specific embodiments, the abnormal operation monitoring device may further include:

[0056] The relationship storage module is used to organize the relationships and store each on-site personnel, their corresponding on-site operation and maintenance permissions, authorized operation and maintenance assets, and on-site operation and maintenance scenarios in the local on-site personnel security archive.

[0057] In some specific embodiments, the information collection module 11 can be used to identify on-site maintenance commands and data operation instructions based on the on-site maintenance scenario, so as to determine abnormal on-site maintenance commands and abnormal data operation instructions.

[0058] In some specific embodiments, the model generation module 12 may specifically include:

[0059] The model training unit is used to generate an abnormal behavior database based on the correlation and the abnormal operation behavior, and to train a preset model based on the data in the abnormal behavior database to obtain an abnormal behavior monitoring model.

[0060] In some specific embodiments, the abnormal operation monitoring device may further include:

[0061] The identification and prompting module is used to set operation reminder icons in the abnormal behavior monitoring model based on the abnormal operation behavior, so that when the on-site personnel exhibit abnormal operation behavior, the application system user can remind the on-site personnel of the operation through the operation reminder icons.

[0062] In some specific embodiments, the operation information confirmation module 13 may specifically include:

[0063] The alarm information acquisition unit is used to acquire on-site behavior alarm information sent by the user of the application system through the preset text recognition function / QR code of the preset service desk, and to determine abnormal operation information based on the on-site behavior alarm information.

[0064] Furthermore, embodiments of this application also disclose an electronic device, Figure 4 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application.

[0065] Figure 4 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of this application. Specifically, the electronic device 20 may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the abnormal operation monitoring method disclosed in any of the foregoing embodiments. Furthermore, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0066] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0067] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include operating system 221, computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0068] The operating system 221 is used to manage and control the various hardware devices on the electronic device 20 and the computer program 222, which may be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program capable of performing the abnormal operation monitoring method executed by the electronic device 20 as disclosed in any of the foregoing embodiments, the computer program 222 may further include a computer program capable of performing other specific tasks.

[0069] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned abnormal operation monitoring method. Specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0070] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0071] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0072] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0073] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0074] The technical solutions provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for monitoring abnormal operations, characterized in that, Applied to application system providers, including: Based on the operation and maintenance information set by the application system user for the target application, determine the association between each on-site personnel and on-site operation and maintenance permissions, authorized operation and maintenance assets and on-site operation and maintenance scenarios, and identify on-site operation behaviors based on the on-site operation and maintenance scenarios to collect abnormal operation behaviors. An abnormal behavior monitoring model is generated based on the association and the abnormal operation behavior, and the abnormal behavior monitoring model is sent to the ELK system of the application system user so that the application system user can use the abnormal behavior monitoring model to monitor the behavior of each of the on-site personnel. The system obtains on-site behavior alarm information sent by the user of the application system through a preset offline data transmission method, and determines abnormal operation information based on the on-site behavior alarm information.

2. The abnormal operation monitoring method according to claim 1, characterized in that, The method for determining the association between on-site personnel and their on-site maintenance permissions, authorized maintenance assets, and on-site maintenance scenarios based on the maintenance information set by the application system user for the target application includes: On-site personnel apply for maintenance permissions through the application system user's default service desk to obtain on-site maintenance permissions. Obtain the authorized operation and maintenance assets of the application system user, and determine the association between each on-site personnel and the on-site operation and maintenance permissions, the authorized operation and maintenance assets, and the on-site operation and maintenance scenario.

3. The abnormal operation monitoring method according to claim 2, characterized in that, After determining the association between each on-site personnel and their on-site maintenance permissions, authorized maintenance assets, and on-site maintenance scenarios based on the maintenance information set by the application system user for the target application, the process also includes: The aforementioned relationships are organized, and the on-site personnel, their corresponding on-site operation and maintenance permissions, authorized operation and maintenance assets, and on-site operation and maintenance scenarios are stored in the local on-site personnel security archive.

4. The abnormal operation monitoring method according to claim 1, characterized in that, The process of identifying on-site operational behaviors based on the on-site operation and maintenance scenario to collect abnormal operational behaviors includes: Based on the on-site maintenance scenario, on-site maintenance commands and data operation instructions are identified to determine abnormal on-site maintenance commands and abnormal data operation instructions.

5. The abnormal operation monitoring method according to claim 1, characterized in that, The step of generating an abnormal behavior monitoring model based on the correlation and the abnormal operation behavior includes: An abnormal behavior database is generated based on the aforementioned relationships and abnormal operation behaviors, and a preset model is trained based on the data in the abnormal behavior database to obtain an abnormal behavior monitoring model.

6. The abnormal operation monitoring method according to claim 1, characterized in that, After generating the abnormal behavior monitoring model based on the correlation and the abnormal operation behavior, the method further includes: Based on the abnormal operation behavior, an operation reminder icon is set in the abnormal behavior monitoring model so that when the on-site personnel exhibit abnormal operation behavior, the application system user can remind the on-site personnel of the operation through the operation reminder icon.

7. The abnormal operation monitoring method according to claim 1, characterized in that, The step of obtaining on-site behavior alarm information sent by the application system user through a preset offline data transmission method, and determining abnormal operation information based on the on-site behavior alarm information, includes: The system obtains on-site behavior alarm information sent by the user of the application system through the preset text recognition function / QR code of the preset service desk, and determines abnormal operation information based on the on-site behavior alarm information.

8. An abnormal operation monitoring device, characterized in that, Applied to application system providers, including: The information identification module is used to determine the relationship between each on-site personnel and on-site operation and maintenance permissions, authorized operation and maintenance assets and on-site operation and maintenance scenarios based on the operation and maintenance information set by the application system user for the target application, and to identify on-site operation behaviors based on the on-site operation and maintenance scenarios in order to collect abnormal operation behaviors. The model generation module is used to generate an abnormal behavior monitoring model based on the association relationship and the abnormal operation behavior, and send the abnormal behavior monitoring model to the ELK system of the application system user so that the application system user can use the abnormal behavior monitoring model to monitor the behavior of each of the on-site personnel. The operation information confirmation module is used to obtain on-site behavior alarm information sent by the user of the application system through a preset offline data transmission method, and to determine abnormal operation information based on the on-site behavior alarm information.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the abnormal operation monitoring method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, Used to store computer programs, which, when executed by a processor, implement the abnormal operation monitoring method as described in any one of claims 1 to 7.

Images