A desktop software management method based on database and related device

Abstract

The present invention discloses a desktop software management method based on a database and a related device, and relates to the field of computer technology. The method includes: obtaining usage data and operation log data of desktop software, and classifying the usage of several desktop software; obtaining user usage habit data of commonly used desktop software to sort and layout the software; performing security risk assessment on each desktop software based on the attack state library by using vulnerability risk analysis combined with operation log data; determining the target security policy corresponding to each desktop software in several non-redundant security policies based on the security risk assessment result to perform security protection; obtaining the resource load and operation data when each desktop software performs security protection to adjust the resource allocation of the cloud desktop, and storing the operation data in the corresponding storage node. The present invention improves the reliability of desktop software management, and enables desktop software management to achieve a more ideal effect.

Description

Technical Field

[0001] The present invention mainly relates to the field of computer technology, and in particular to a desktop software management method based on a database and related devices. Background Art

[0002] With the development of Internet technology, more and more application software has appeared in the market, and more and more application software has been installed on the desktop by users. How to manage desktop software has become an issue that needs attention. At present, for the management of desktop software, it is rare to sort and arrange commonly used desktop software according to user usage habits, resulting in users often not being able to quickly find the desktop software they need, affecting the user's operating experience. For the risk assessment of desktop software, currently, interception technology is usually used to conduct software risk assessment. Interception technology mainly infers the risk of software by analyzing the running trajectory of the software, but this method is difficult to comprehensively and accurately assess the security of the software, so that the deviation between the obtained security risk assessment results and the actual situation is too large, making it difficult to ensure the safe operation of desktop software. For security policies, they are basically manually configured by relevant personnel, and there may be redundancy in security policies, which leads to an increase in the time consumed in selecting security policies. At the same time, the reliability of the determination of security policies cannot be stably guaranteed, so that the security protection of desktop software fails to meet the expected requirements. The resource adjustment and allocation of desktop software is also an important research issue in software management. If there is a lack of timely resource allocation to the desktop, the desktop software will be stuck or even crash, making the management of desktop software unable to achieve the expected effect and unable to realize the expected artificial intelligence desktop software management. Summary of the invention

[0003] The purpose of the present invention is to overcome the deficiencies of the prior art. The present invention provides a desktop software management method and related devices based on a database, which improves the reliability of desktop software management and enables desktop software management to achieve a more ideal effect.

[0004] In order to solve the above technical problems, the present invention provides a desktop software management method based on a database, which is applied to a cloud desktop and a cloud server, wherein the cloud server is deployed with an artificial intelligence engine, and the cloud desktop is communicatively connected with the cloud server; the method comprises:

[0005] Obtaining usage data and operation log data of several desktop software of the cloud desktop in each time period from the database of the cloud server, and classifying the usage of several desktop software based on the usage data by the artificial intelligence engine to obtain several commonly used desktop software and infrequently used desktop software;

[0006] Obtaining user usage habit data of several commonly used desktop software in a database, and sorting and arranging the several commonly used desktop software in a cloud desktop based on the user usage habit data, to obtain the sorted and arranged commonly used desktop software;

[0007] Construct an attack status library, and perform security risk assessment on the uncommon desktop software and the sorted and arranged common desktop software based on the attack status library using vulnerability risk analysis combined with the operation log data to obtain corresponding security risk assessment results;

[0008] Acquire a plurality of non-redundant security policies, determine a target security policy corresponding to the uncommonly used desktop software and the sorted and arranged common desktop software from the plurality of non-redundant security policies based on the security risk assessment result, and perform security protection on the uncommonly used desktop software and the sorted and arranged common desktop software based on the target security policy;

[0009] The resource load and operation data of the uncommon desktop software and the sorted and arranged common desktop software during security protection are obtained, and the resource allocation of the cloud desktop is adjusted based on the resource load, and the operation data is stored in the corresponding storage node of the database.

[0010] Optionally, the classifying the usage of the plurality of desktop software based on the usage data to obtain a plurality of commonly used desktop software and infrequently used desktop software includes:

[0011] Calculate the total running frequency, total usage time and total opening times of each desktop software based on the usage data, and calculate the common score of each desktop software based on the total running frequency, total usage time and total opening times;

[0012] The common score is compared with a preset threshold to obtain a comparison result, and the usage of the plurality of desktop software is classified based on the comparison result to obtain a plurality of commonly used desktop software and uncommonly used desktop software.

[0013] Optionally, the step of sorting and arranging a plurality of commonly used desktop software in the cloud desktop based on the user usage habit data to obtain the sorted and arranged commonly used desktop software includes:

[0014] Obtain candidate label information corresponding to the sample desktop software, determine a candidate label information vector for each candidate label information, and perform clustering based on the candidate label information vector to obtain a plurality of candidate label information clusters;

[0015] Constructing a corresponding cluster label for each candidate label information cluster, obtaining a classification model based on the cluster label, and classifying a number of commonly used desktop software based on the classification model to obtain commonly used desktop software in each category;

[0016] Extracting a plurality of usage order information of various categories of commonly used desktop software based on the user usage habit data, counting the frequency of the usage order information, and determining the ranking of the target software based on the frequency of the usage order information combined with a weighted multi-branch tree;

[0017] Based on the target software sorting, the commonly used desktop software of each category is sorted and arranged in the cloud desktop to obtain the sorted and arranged commonly used desktop software.

[0018] Optionally, the building of the attack status library includes:

[0019] Acquire historical attack behavior information and historical security status information sets, and construct an attack status graph based on the historical attack behavior information and historical security status information sets;

[0020] The state transition probability of the attack state diagram is calculated based on the attack and defense game matrix, and the attack state library is constructed based on the state transition probability combined with the historical attack path.

[0021] Optionally, the vulnerability risk analysis based on the attack status library is combined with the operation log data to perform security risk assessment on the uncommon desktop software and the commonly used desktop software after sorting and layout to obtain corresponding security risk assessment results, including:

[0022] Extracting log feature data from the operation log data, and performing attack behavior recognition on the uncommon desktop software and the sorted and arranged common desktop software based on the attack state library and the log feature data to obtain an attack behavior recognition result;

[0023] Extracting software package information from the operation log data, and detecting vulnerability risks of the uncommon desktop software and the sorted and arranged common desktop software using a software dependency network based on the software package information;

[0024] Based on the attack behavior identification results and vulnerability risks, security risk assessment is performed on the uncommonly used desktop software and the sorted and arranged commonly used desktop software to obtain corresponding security risk assessment results.

[0025] Optionally, the obtaining of several non-redundant security policies includes:

[0026] Obtain all security policies, and compare two adjacent security policies in order according to the arrangement order of all security policies to obtain a comparison result;

[0027] Based on the comparison result, redundant security policies among all security policies are determined, and the redundant security policies among all security policies are deleted in sequence to obtain a plurality of non-redundant security policies.

[0028] Optionally, determining a target security policy corresponding to the uncommon desktop software and the sorted and arranged common desktop software from among a plurality of non-redundant security policies based on the security risk assessment result includes:

[0029] Based on the security risk assessment result, a search tree is used to perform policy matching between the uncommon desktop software and the sorted and arranged common desktop software in a plurality of non-redundant security policies to determine a corresponding target security policy.

[0030] Optionally, adjusting resource allocation of the cloud desktop based on the resource load condition and storing the running data in a corresponding storage node of a database includes:

[0031] Determine whether the resource load of the uncommon desktop software and the arranged common desktop software during security protection is greater than a preset load threshold baseline, and if the resource load is greater than the preset load threshold baseline, perform hot addition of computing resources on the cloud desktop;

[0032] The operation data is divided into necessary operation data and non-essential operation data, the necessary operation data is stored in a hot storage node of a database, and the non-essential data is stored in a cold storage node of the database.

[0033] In addition, the present invention also provides a desktop software management device based on a database, which is applied to a cloud desktop and a cloud server, wherein the cloud server is deployed with an artificial intelligence engine, and the cloud desktop is communicatively connected with the cloud server; the device comprises:

[0034] Software usage classification module: used to obtain usage data and operation log data of several desktop software of the cloud desktop in each time period from the database of the cloud server, and the artificial intelligence engine classifies the usage of several desktop software based on the usage data to obtain several commonly used desktop software and infrequently used desktop software;

[0035] Software sorting and layout module: used to obtain user usage habit data of several commonly used desktop software in the database, and sort and layout several commonly used desktop software in the cloud desktop based on the user usage habit data to obtain the commonly used desktop software after sorting and layout;

[0036] Software security risk assessment module: used to build an attack status library, and based on the attack status library, perform security risk assessment on the uncommon desktop software and the sorted and arranged common desktop software using vulnerability risk analysis combined with the operation log data to obtain corresponding security risk assessment results;

[0037] Software security protection module: used to obtain a plurality of non-redundant security policies, determine a target security policy corresponding to the uncommon desktop software and the sorted and arranged common desktop software from the plurality of non-redundant security policies based on the security risk assessment result, and perform security protection on the uncommon desktop software and the sorted and arranged common desktop software based on the target security policy;

[0038] Resource allocation and data storage module: used to obtain the resource load conditions and operation data when the uncommon desktop software and the commonly used desktop software after sorting and layout are used for security protection, and adjust the resource allocation of the cloud desktop based on the resource load conditions, and store the operation data in the corresponding storage node of the database.

[0039] In addition, the present invention also provides a database-based desktop software management system, the system includes a cloud desktop and a cloud server, the cloud server is deployed with an artificial intelligence engine, the cloud desktop is communicatively connected to the cloud server, and the system is configured to execute the above-mentioned database-based desktop software management method.

[0040] In an embodiment of the present invention, the usage of several desktop software is classified based on the total running frequency, total usage time and total opening times calculated from the usage data, avoiding the one-sidedness caused by the usage classification based on a single factor, and improving the accuracy of the usage classification of desktop software. The commonly used desktop software is classified according to the classification model generated by the clustering label, and then the commonly used desktop software of each category is sorted and arranged in the cloud desktop based on the user's usage habit data, so that the commonly used desktop software sorted and arranged in the cloud desktop is more in line with the user's usage habits, allowing users to quickly find the desktop software they need, and improving the user's operating experience. Based on the attack state library, the vulnerability risk analysis is combined with the operation log data to perform security risk assessment on the uncommon desktop software and the commonly used desktop software after sorting and layout, which can more comprehensively and accurately evaluate the security of the software, avoid the deviation between the obtained security risk assessment results and the actual situation, and ensure the safe operation of the desktop software. Based on the security risk assessment results, the search tree is used to determine the target security policy corresponding to the uncommon desktop software and the commonly used desktop software after sorting and layout in several non-redundant security policies, which can more quickly and accurately search for the required security policy and ensure the reliability of the security protection of the desktop software. When each desktop software is in the running state for security protection, it can determine whether hot addition of computing resources is needed based on the resource load situation, so as to ensure the timeliness and accuracy of cloud desktop resource allocation, avoid desktop software jams or even crashes, and store running data in the corresponding hot and cold storage nodes to avoid waste of storage resources, so that desktop software management can achieve more ideal results and realize artificial intelligence-based desktop software management. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0042] Figure 1 It is a flowchart of a desktop software management method based on a database in an embodiment of the present invention;

[0043] Figure 2 is a flowchart of a desktop software management method based on a database in another embodiment of the present invention;

[0044] Figure 3 It is a schematic diagram of the structure of a desktop software management system based on a database in an embodiment of the present invention;

[0045] Figure 4 It is a schematic diagram of the structural composition of a database-based desktop software management device in an embodiment of the present invention. DETAILED DESCRIPTION

[0046] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0047] Embodiment 1

[0048] See also Figure 1 , Figure 1 The present invention is a flowchart of a database-based desktop software management method in an embodiment of the present invention. The method is applied to a cloud desktop and a cloud server. The cloud server is deployed with an artificial intelligence engine. The cloud desktop is connected to the cloud server in communication. The method includes:

[0049] S11: obtaining usage data and operation log data of several desktop software of the cloud desktop in each time period from the database of the cloud server, and the artificial intelligence engine classifies the usage of several desktop software based on the usage data to obtain several commonly used desktop software and infrequently used desktop software;

[0050] In the specific implementation process of the present invention, the usage of several desktop software is classified based on the usage data to obtain several commonly used desktop software and infrequently used desktop software, including: calculating the total running frequency, total usage time and total opening times of each desktop software based on the usage data, and calculating the common score of each desktop software based on the total running frequency, total usage time and total opening times; comparing the common score with a preset threshold to obtain a comparison result, and classifying the usage of several desktop software based on the comparison result to obtain several commonly used desktop software and infrequently used desktop software.

[0051] Specifically, the usage data and operation log data of several desktop software of the cloud desktop in each time period are obtained in the database of the cloud server. The database of the cloud server is a database deployed in the cloud, which has a large storage capacity and can provide a highly scalable, reliable and available database solution. The database will regularly collect the usage data and operation log data of each desktop software in the cloud desktop. The usage data includes the running frequency of each desktop software in each time period, the usage duration and the number of times the software is opened each time. The operation log data includes the traffic data of each desktop software in each time period, the software package information it depends on and the access behavior information. The total running frequency, total usage time and total opening times of each desktop software are calculated based on the usage data. The artificial intelligence engine is a tool that uses artificial intelligence technology to perform various tasks. The artificial intelligence engine can obtain the total running frequency, total usage time and total opening times by adding the running frequency, usage time and total opening times of each desktop software in each time period in the usage data, and calculate the common score of each desktop software based on the total running frequency, total usage time and total opening times. The common score of each desktop software is obtained by multiplying the total running frequency, total usage time and total opening times with the corresponding preset weights, and then adding the multiplication results. The common score is compared with a preset threshold, and the usage of several desktop software is classified based on the comparison result to obtain several common desktop software and infrequent desktop software, that is, the common score is compared with the preset threshold, if the common score is greater than or equal to the preset threshold, the desktop software is classified as common desktop software, if the common score is less than the preset threshold, the desktop software is classified as infrequent desktop software, according to the layout of the divided common desktop software and infrequent desktop software on the cloud desktop, the common desktop software is divided into common areas, and the infrequent desktop software is divided into infrequent areas, so that users can intuitively understand their common desktop software. For some tool-type desktop software, such as dictionaries and screenshot software, the usage time is not high, but the number of openings is large, so the total running frequency, total usage time and total opening times are all considered as common scores, which can avoid the one-sidedness brought by the classification of usage by a single factor and improve the accuracy of the classification of desktop software usage.

[0052] S12: obtaining user usage habit data of a plurality of commonly used desktop software in a database, and sorting and arranging the plurality of commonly used desktop software in a cloud desktop based on the user usage habit data to obtain the sorted and arranged commonly used desktop software;

[0053] In the specific implementation process of the present invention, the method of sorting and arranging a number of commonly used desktop software in a cloud desktop based on the user usage habit data to obtain the commonly used desktop software after sorting and arrangement includes: obtaining candidate label information corresponding to the sample desktop software, and determining the candidate label information vector of each candidate label information, clustering based on the candidate label information vector, and obtaining a number of candidate label information clusters; constructing a corresponding cluster label for each candidate label information cluster, obtaining a classification model based on the cluster label, and classifying a number of commonly used desktop software based on the classification model to obtain commonly used desktop software of each category; extracting a number of usage order information of commonly used desktop software of each category based on the user usage habit data, counting the frequency of the usage order information, and determining the target software ranking based on the frequency of the usage order information combined with a weighted multi-branch tree; sorting and arranging the commonly used desktop software of each category in the cloud desktop based on the target software ranking to obtain the commonly used desktop software after sorting and arrangement.

[0054] Specifically, the user usage habit data of several commonly used desktop software are obtained from the database of the cloud server. The user usage habit data includes the order in which the users use each commonly used desktop software. The candidate label information corresponding to the sample desktop software is obtained. The sample desktop software is a sample of the desktop software that needs to be classified. It contains multiple categories of desktop software. Each sample desktop software has corresponding candidate label information, such as the label information of the architectural drawing software is architecture and drawing. The candidate label information vector of each candidate label information is determined, and the candidate label information is vectorized through the word embedding model to obtain the candidate label information vector, that is, the candidate label is input into the word embedding model, and each word or phrase in the candidate label is mapped to a vector on the real number field, and then the vectors on the real number field are fused to obtain the candidate label information vector. Clustering is performed based on the candidate label information vector, and the similarity between the candidate label information vectors is calculated. The Euclidean distance can be used for calculation, and the candidate label information vectors with higher similarity are divided into a cluster to obtain several candidate label information clusters. Construct a corresponding cluster label for each candidate label information cluster, calculate the number of candidate label information clusters, construct a natural number sequence of the same dimension based on the calculated number, combine the natural numbers in the natural number sequence with preset characters, and obtain a cluster label. Based on the cluster label, obtain a classification model, input the application name of the sample commonly used desktop software into the initial classification model, the initial classification model is a convergence model obtained by inputting the sample data set into the deep data network for training, determine the predicted label cluster according to the initial classification model, determine the target loss according to the predicted label cluster and the cluster label, train the initial classification model according to the target loss, and obtain the final classification model. Based on the classification model, classify several commonly used desktop software, input the application name of the commonly used desktop software into the classification model for classification, and obtain commonly used desktop software of various categories, such as classifying architectural drawing software into one category, office communication software into another category, etc. AI artificial intelligence technology is used in the classification model, so that the created classification model can achieve intelligent classification of desktop software. Based on the user usage habit data, several usage order information of various categories of commonly used desktop software are extracted. For example, when a user uses engineering drawing software, the user's usage order is counted, the frequency of the usage order information is counted, the frequency of each usage order is counted, and the target software ranking is determined based on the frequency of the usage order information combined with a weighted multi-branch tree. Each frequency of the usage order information is configured with a corresponding weight. The weighted multi-branch tree is used to store the frequency of each usage order information and the corresponding weight. The weighted multi-branch tree is searched by using a Monte Carlo tree search algorithm. The target software ranking can be determined according to the search results. The target software ranking is the usage order of each category of commonly used desktop software that is closest to the user's actual situation.Based on the target software sorting, the commonly used desktop software of each category is sorted and arranged in the cloud desktop, and the commonly used desktop software is classified into one category according to the corresponding category, and placed in the corresponding area of ​​the cloud desktop, and then the commonly used desktop software classified into one category is sorted in the cloud desktop according to the target software sorting, so that the commonly used desktop software after sorting and arrangement can be obtained. The commonly used desktop software sorted and arranged in the cloud desktop is more in line with the user's usage habits, allowing the user to quickly find the desktop software he needs, and improving the user's operating experience.

[0055] S13: constructing an attack status library, and performing security risk assessment on the uncommon desktop software and the sorted and arranged common desktop software based on the attack status library using vulnerability risk analysis combined with the operation log data to obtain corresponding security risk assessment results;

[0056] In the specific implementation process of the present invention, the construction of the attack state library includes: obtaining historical attack behavior information and historical security status information sets, and constructing an attack state graph based on the historical attack behavior information and historical security status information sets; calculating the state transition probability of the attack state graph based on the attack and defense game matrix, and constructing the attack state library based on the state transition probability combined with the historical attack path.

[0057] Furthermore, the vulnerability risk analysis based on the attack status library is combined with the operation log data to perform security risk assessment on the uncommon desktop software and the commonly used desktop software after sorting and layout, and obtain corresponding security risk assessment results, including: extracting log feature data from the operation log data, and identifying attack behaviors of the uncommon desktop software and the commonly used desktop software after sorting and layout based on the attack status library and the log feature data to obtain attack behavior identification results; extracting software package information from the operation log data, and detecting vulnerability risks of the uncommon desktop software and the commonly used desktop software after sorting and layout based on the software package information using a software dependency network; and performing security risk assessment on the uncommon desktop software and the commonly used desktop software after sorting and layout based on the attack behavior identification results and vulnerability risks to obtain corresponding security risk assessment results.

[0058] Specifically, historical attack behavior information and historical security status information sets are obtained. The historical attack behavior information is the attack behaviors suffered by each desktop software in history, such as account information theft or Trojan implantation, etc. The historical security status information set includes the number of successful attacks and the number of failures and the reasons, etc. An attack state graph is constructed based on the historical attack behavior information and the historical security status information set. The historical attack behavior information is used as a node and the historical security status information set is used as an edge to construct the attack state graph. The state transition probability of the attack state graph is calculated based on the attack and defense game matrix. The attack and defense game matrix is ​​a matrix composed of all protection measures and all possible attack behaviors of the software in the running state. The state transition probability of the attack state graph can be the probability of transferring from a certain attack behavior on the software to another attack behavior, such as from invading the software account to implanting a Trojan. And based on the state transition probability, an attack state library is constructed in combination with historical attack paths. Historical attack paths include malware installation-adding vulnerabilities-invading network links, etc. Extract log feature data from the operation log data, filter invalid content in the operation log data, and extract log feature data from the operation log data after filtering invalid content according to a preset feature structure, wherein the log feature data includes timestamp information, loop mark, access behavior information, etc. Perform attack behavior identification on the uncommon desktop software and the commonly used desktop software after sorting and layout based on the attack state library combined with the log feature data, obtain attack behavior identification results by matching the attack state library with the log feature data, and derive various attacks suffered by each desktop software. Extract software package information from the operation log data. As software becomes more and more complex, third-party software packages will be used to assist the development of software systems during development. However, the vulnerability of software packages may be introduced when the software packages are introduced. Therefore, it is necessary to detect the vulnerability risks brought by the software package information. The operation path is extracted from the operation log data. The operation path contains software package information. The software package information includes software package name and dependent software packages. Based on the software package information, the vulnerability risks of the uncommon desktop software and the commonly used desktop software after sorting and layout are detected using the software dependency network. The vulnerability information is obtained from the public vulnerability information network. The vulnerability information includes vulnerability description and security level, etc., and the association relationship between the vulnerability information and the software package information is constructed. For example, if the vulnerability information is CVE-2015-9926 and the affected software package is php3, the association relationship is php3->CVE-2015-9926. According to the association relationship between the vulnerability information and the software package information, the software package dependency relationship graph is constructed using the software dependency network. The software dependency network is constructed through software package dependency metadata. The software package dependency metadata is such as software package B depends on software package A, etc. The threat coefficient of the vulnerability is determined using the software package dependency relationship graph according to the software package information. The vulnerability risk is calculated according to the threat coefficient of the vulnerability, which can more intuitively and accurately evaluate the vulnerability risk.Based on the attack behavior identification results and vulnerability risks, security risk assessment is performed on the uncommon desktop software and the commonly used desktop software after sorting and layout. The attack behaviors and vulnerability risks of each desktop software have corresponding security risk intervals. After determining the security risk intervals corresponding to each desktop software, the corresponding security risk assessment results are obtained. The security of the software can be assessed more comprehensively and accurately, avoiding excessive deviations between the security risk assessment results and the actual situation, and ensuring the safe operation of the desktop software.

[0059] S14: obtaining a plurality of non-redundant security policies, determining a target security policy corresponding to the infrequently used desktop software and the sorted and arranged common desktop software from the plurality of non-redundant security policies based on the security risk assessment result, and performing security protection on the infrequently used desktop software and the sorted and arranged common desktop software based on the target security policy;

[0060] In the specific implementation process of the present invention, the obtaining of several non-redundant security policies includes: obtaining all security policies, comparing two adjacent security policies in sequence according to the arrangement order of all security policies, and obtaining comparison results; determining redundant security policies among all security policies based on the comparison results, and deleting redundant security policies among all security policies in sequence to obtain several non-redundant security policies.

[0061] Furthermore, determining a target security policy corresponding to the infrequently used desktop software and the sorted and arranged commonly used desktop software in several non-redundant security policies based on the security risk assessment result includes: performing policy matching of the infrequently used desktop software and the sorted and arranged commonly used desktop software in several non-redundant security policies using a search tree based on the security risk assessment result to determine the corresponding target security policy.

[0062] Specifically, all security policies are obtained from the database, and two adjacent security policies are compared in sequence according to the arrangement order of all security policies to obtain the comparison result, that is, by comparing the source IP address, destination IP address, source port and service content of the two security policies, it is detected whether the two security policies are the same or one of the security policies completely contains the other security policy. Based on the comparison result, the redundant security policies in all security policies are determined. If the comparison results are the same, one of the two security policies is a redundant security policy. After the first comparison is completed, the redundant security policies are deleted. According to the arrangement order after deleting the redundant security policies, the security policies are compared again, and the redundant security policies in all security policies are deleted in sequence until there are no redundant security policies that can be deleted. Then, several non-redundant security policies can be obtained, and the comparison of all security policies is completed in sequence. After deleting all redundant security policies, all non-redundant security policies are obtained, so that the redundant security policy can be checked simply and efficiently without omissions. Based on the security risk assessment result, a search tree is used to perform policy matching of the uncommon desktop software and the commonly used desktop software after sorting and layout in several non-redundant security policies to determine the corresponding target security policy. The search tree contains the security risk intervals of each security risk assessment result and the policy identifiers corresponding to the security risk intervals. The policy matching is performed through the search tree to obtain the corresponding target security policy. The target security policy may be to restrict the access rights of the software and the deployment of firewalls, etc. The corresponding target security policy is deployed in the uncommon desktop software and the commonly used desktop software after sorting and layout to perform security protection and ensure the reliability of the security protection of the desktop software.

[0063] S15: Obtain resource load conditions and operation data when the uncommon desktop software and the sorted and arranged common desktop software are protected for security, adjust resource allocation of the cloud desktop based on the resource load conditions, and store the operation data in a corresponding storage node of the database.

[0064] In the specific implementation process of the present invention, the resource allocation of the cloud desktop is adjusted based on the resource load situation, and the operating data is stored in the corresponding storage node of the database, including: judging whether the resource load situation when the uncommon desktop software and the commonly used desktop software after sorting and layout are protected by security is greater than a preset load threshold baseline, if the resource load situation is greater than the preset load threshold baseline, hot adding computing resources to the cloud desktop; dividing the operating data into necessary operating data and non-essential operating data, storing the necessary operating data in the hot storage node of the database, and storing the non-essential data in the cold storage node of the database.

[0065] Specifically, the resource load and operation data of the uncommon desktop software and the commonly used desktop software after sorting and layout are obtained when security protection is performed, that is, the resource load and operation data are monitored, the resource load includes the memory resource load and the CPU computing resource peak and the frequency of the peak, and the operation data includes the attack resistance data, the software normal operation log and the software usage data. It is judged whether the resource load of the uncommon desktop software and the commonly used desktop software after sorting and layout is greater than the preset load threshold baseline when security protection is performed. The preset load threshold baseline can be set by the user according to the actual situation. If the resource load is greater than the preset load threshold baseline, the cloud desktop is hot-added with computing resources. The hot addition of computing resources refers to adding or modifying computing resources online without stopping the computer. The part of the computing resource load that exceeds the preset load threshold baseline is mapped to the part that exceeds the preset load threshold baseline and the computing resources that need to be hot-added. The resource amount of the hot-added computing resources is determined according to the mapping relationship, and then the desktop software that exceeds the preset load threshold baseline is added with resources according to the hot-added computing resources, so as to achieve the timeliness and accuracy of cloud desktop resource allocation and avoid the desktop software from freezing or even crashing. The operation data is divided into necessary operation data and non-necessary operation data, and the necessary operation data and non-necessary operation data are determined according to the preset judgment criteria for the operation data, and the preset judgment criteria are data division standards specified according to expert knowledge, and the load of each storage node in the database within a preset period is calculated, and the data block access frequency of each storage node is calculated. According to the load and data block access frequency of each storage node within the preset period, cold storage nodes and hot storage nodes are divided, and the necessary operation data is stored in the hot storage node of the database, and the non-necessary data is stored in the cold storage node of the database, so as to avoid the waste of storage resources. A complete artificial intelligence operation process for desktop software management is formed.

[0066] In an embodiment of the present invention, the usage of several desktop software is classified based on the total running frequency, total usage time and total opening times calculated from the usage data, avoiding the one-sidedness caused by the usage classification based on a single factor, and improving the accuracy of the usage classification of desktop software. The commonly used desktop software is classified according to the classification model generated by the clustering label, and then the commonly used desktop software of each category is sorted and arranged in the cloud desktop based on the user's usage habit data, so that the commonly used desktop software sorted and arranged in the cloud desktop is more in line with the user's usage habits, allowing users to quickly find the desktop software they need, and improving the user's operating experience. Based on the attack state library, the vulnerability risk analysis is combined with the operation log data to perform security risk assessment on the uncommon desktop software and the commonly used desktop software after sorting and layout, which can more comprehensively and accurately evaluate the security of the software, avoid the deviation between the obtained security risk assessment results and the actual situation, and ensure the safe operation of the desktop software. Based on the security risk assessment results, the search tree is used to determine the target security policy corresponding to the uncommon desktop software and the commonly used desktop software after sorting and layout in several non-redundant security policies, which can more quickly and accurately search for the required security policy and ensure the reliability of the security protection of the desktop software. When each desktop software is in the running state for security protection, it can determine whether hot addition of computing resources is needed based on the resource load situation, so as to ensure the timeliness and accuracy of cloud desktop resource allocation, avoid desktop software jams or even crashes, and store running data in the corresponding hot and cold storage nodes to avoid waste of storage resources, so that desktop software management can achieve more ideal results and realize artificial intelligence-based desktop software management.

[0067] Embodiment 2

[0068] See also Figure 2 , Figure 2 : is a flowchart of a desktop software management method based on a database in another embodiment of the present invention, the method is applied to a cloud desktop and a cloud server, the cloud server is deployed with an artificial intelligence engine, and the cloud desktop is communicatively connected with the cloud server; the method includes:

[0069] S201: Obtaining usage data and operation log data of several desktop software of the cloud desktop in each time period from the database of the cloud server, and classifying the usage of several desktop software based on the usage data by the artificial intelligence engine to obtain several commonly used desktop software and infrequently used desktop software;

[0070] S202: obtaining user usage habit data of a plurality of commonly used desktop software in a database, and sorting and arranging the plurality of commonly used desktop software in a cloud desktop based on the user usage habit data to obtain the sorted and arranged commonly used desktop software;

[0071] S203: Acquire historical attack behavior information and a historical security status information set, and construct an attack status graph based on the historical attack behavior information and the historical security status information set;

[0072] In the specific implementation process of the present invention, historical attack behavior information and historical security status information sets are obtained. The historical attack behavior information is the attack behavior suffered by each desktop software in history, such as account information theft or Trojan horse implantation, etc. The historical security status information set includes the number of successful attacks and the number of failures and reasons, etc. An attack status graph is constructed based on the historical attack behavior information and the historical security status information set, and the historical attack behavior information is used as a node and the historical security status information set is used as an edge to construct the attack status graph.

[0073] S204: Calculate the state transition probability of the attack state diagram based on the attack and defense game matrix, and build an attack state library based on the state transition probability combined with the historical attack path;

[0074] In the specific implementation process of the present invention, the state transition probability of the attack state diagram is calculated based on the attack and defense game matrix. The attack and defense game matrix is ​​a matrix composed of all the protection measures and all possible attack behaviors of the software in the running state. The state transition probability of the attack state diagram can be the probability of transferring from a certain attack behavior on the software to another attack behavior, such as from invading the software account to implanting a Trojan horse. And based on the state transition probability combined with the historical attack path, an attack state library is constructed, and the historical attack path is such as malware installation-adding vulnerability-invading network link, etc.

[0075] S205: extracting log feature data from the operation log data, and performing attack behavior recognition on the uncommon desktop software and the sorted and arranged common desktop software based on the attack state library and the log feature data to obtain an attack behavior recognition result;

[0076] In the specific implementation process of the present invention, log feature data is extracted from the operation log data, invalid content in the operation log data is filtered, and log feature data in the operation log data after invalid content is filtered is extracted according to a preset feature structure, and the log feature data includes timestamp information, loop mark and access behavior information, etc. Based on the attack state library combined with the log feature data, attack behavior identification is performed on the uncommon desktop software and the commonly used desktop software after sorting and layout, and the attack state library is matched with the log feature data to obtain the attack behavior identification result, and the various attacks suffered by each desktop software are obtained.

[0077] S206: extracting software package information from the operation log data, and detecting vulnerability risks of the uncommon desktop software and the sorted and arranged common desktop software using a software dependency network based on the software package information;

[0078] In the specific implementation process of the present invention, the software package information is extracted from the operation log data. As the software becomes more and more complex, it will quote third-party software packages to assist the development of the software system during development. However, when the software package is introduced, its vulnerability may be introduced together. Therefore, it is necessary to detect the vulnerability risk brought by the software package information. The operation path is extracted according to the operation log data. The operation path contains the software package information. The software package information includes the software package name and dependent software packages. Based on the software package information, the vulnerability risk of the uncommon desktop software and the commonly used desktop software after sorting and layout is detected using the software dependency network. The vulnerability information is obtained from the public vulnerability information network. The vulnerability information includes the vulnerability description and the security level, etc., and the association relationship between the vulnerability information and the software package information is constructed. For example, if the vulnerability information is CVE-2015-9926 and the affected software package is php3, the association relationship is php3->CVE-2015-9926. According to the correlation between vulnerability information and software package information, the software dependency network is used to build a software package dependency graph. The software dependency network is built through software package dependency metadata. Software package dependency metadata, such as software package B depends on software package A, is used to determine the threat coefficient of the vulnerability based on the software package information using the software package dependency graph. The vulnerability risk is calculated based on the threat coefficient of the vulnerability, which can more intuitively and accurately assess the vulnerability risk.

[0079] S207: Performing security risk assessment on the uncommon desktop software and the sorted and arranged common desktop software based on the attack behavior identification result and the vulnerability risk, and obtaining corresponding security risk assessment results;

[0080] In the specific implementation process of the present invention, the security risk assessment of the uncommon desktop software and the commonly used desktop software after sorting and layout is performed based on the attack behavior identification results and vulnerability risks. The attack behaviors and vulnerability risks of each desktop software have corresponding security risk intervals. After determining the security risk intervals corresponding to each desktop software, the corresponding security risk assessment results are obtained. The security of the software can be assessed more comprehensively and accurately, avoiding excessive deviations between the obtained security risk assessment results and the actual situation, and ensuring the safe operation of the desktop software.

[0081] S208: Acquire a plurality of non-redundant security policies, determine a target security policy corresponding to the uncommonly used desktop software and the sorted and arranged common desktop software from the plurality of non-redundant security policies based on the security risk assessment result, and perform security protection on the uncommonly used desktop software and the sorted and arranged common desktop software based on the target security policy;

[0082] S209: Obtaining resource load conditions and operation data when the uncommon desktop software and the arranged and sorted common desktop software are subjected to security protection;

[0083] S210: Determine whether the resource load of the uncommon desktop software and the arranged common desktop software during security protection is greater than a preset load threshold baseline;

[0084] In the specific implementation process of the present invention, it is determined whether the resource load situation when the uncommon desktop software and the commonly used desktop software after sorting and layout are protected for security is greater than the preset load threshold baseline. The preset load threshold baseline can be set by the user according to the actual situation. If the resource load situation is greater than the preset load threshold baseline, step S211 is entered to hot-add computing resources to the cloud desktop. If the resource load situation is not greater than the preset load threshold baseline, step S209 is entered to continue to obtain the resource load situation of each desktop software, that is, continue to monitor the resource load situation so as to take timely response measures when it exceeds the baseline.

[0085] S211: If the resource load condition is greater than a preset load threshold baseline, hot-add computing resources to the cloud desktop;

[0086] During the specific implementation of the present invention, if the resource load situation is greater than the preset load threshold baseline, the cloud desktop is hot-added with computing resources. The hot addition of computing resources refers to adding or modifying computing resources online without shutting down the computer. The computing resource load situation exceeds the preset load threshold baseline. A mapping relationship is established between the part that exceeds the preset load threshold baseline and the computing resources that need to be hot-added. The resource amount of the hot-added computing resources is determined according to the mapping relationship. Then, according to the hot-added computing resources, resources are added to the desktop software that exceeds the preset load threshold baseline, so as to ensure the timeliness and accuracy of cloud desktop resource allocation and avoid freezes or even crashes of the desktop software.

[0087] S212: Divide the operation data into necessary operation data and non-essential operation data, store the necessary operation data in a hot storage node of a database, and store the non-essential data in a cold storage node of a database.

[0088] In the specific implementation process of the present invention, the operating data is divided into necessary operating data and non-essential operating data, and the necessary operating data and non-essential operating data are determined according to preset judgment criteria for the operating data, and the preset judgment criteria are data division standards specified according to expert knowledge. The load of each storage node in the database within a preset period is calculated, and the data block access frequency of each storage node is calculated. Cold storage nodes and hot storage nodes are divided according to the load and data block access frequency of each storage node within the preset period. The necessary operating data is stored in the hot storage nodes of the database, and the non-essential data is stored in the cold storage nodes of the database to avoid waste of storage resources.

[0089] In an embodiment of the present invention, the usage of several desktop software is classified based on the total running frequency, total usage time and total opening times calculated from the usage data, avoiding the one-sidedness caused by the usage classification based on a single factor, and improving the accuracy of the usage classification of desktop software. The commonly used desktop software is classified according to the classification model generated by the clustering label, and then the commonly used desktop software of each category is sorted and arranged in the cloud desktop based on the user's usage habit data, so that the commonly used desktop software sorted and arranged in the cloud desktop is more in line with the user's usage habits, allowing users to quickly find the desktop software they need, and improving the user's operating experience. Based on the attack state library, the vulnerability risk analysis is combined with the operation log data to perform security risk assessment on the uncommon desktop software and the commonly used desktop software after sorting and layout, which can more comprehensively and accurately evaluate the security of the software, avoid the deviation between the obtained security risk assessment results and the actual situation, and ensure the safe operation of the desktop software. Based on the security risk assessment results, the search tree is used to determine the target security policy corresponding to the uncommon desktop software and the commonly used desktop software after sorting and layout in several non-redundant security policies, which can more quickly and accurately search for the required security policy and ensure the reliability of the security protection of the desktop software. When each desktop software is in the running state for security protection, it can determine whether hot addition of computing resources is needed based on the resource load situation, so as to ensure the timeliness and accuracy of cloud desktop resource allocation, avoid desktop software jams or even crashes, and store running data in the corresponding hot and cold storage nodes to avoid waste of storage resources, so that desktop software management can achieve more ideal results and realize artificial intelligence-based desktop software management.

[0090] Embodiment 3

[0091] See also Figure 3 , Figure 3 It is a schematic diagram of the structural composition of a database-based desktop software management system in an embodiment of the present invention. The system includes a cloud desktop 31 and a cloud server 32. The cloud server is deployed with an artificial intelligence engine. The cloud desktop 31 is communicatively connected with the cloud server 32. The system is configured to execute the database-based desktop software management method in the above embodiment.

[0092] In the specific implementation process of the present invention, the cloud desktop 31 establishes a communication connection with the cloud server 32 through the network. The cloud server 32 receives the desktop software management request of the cloud desktop sent by the receiving terminal. An artificial intelligence engine is deployed in the cloud server 32. The artificial intelligence engine is a tool that uses artificial intelligence technology and artificial intelligence algorithms to perform various tasks and functions. The artificial intelligence engine performs data analysis on the relevant desktop software through the acquired data, obtains the data analysis results, and determines the relevant processing of the desktop software according to the data analysis results. The cloud server 32 controls the corresponding desktop software in the cloud desktop 31 to perform relevant processing according to the relevant processing of the desktop software determined by the artificial intelligence engine, and realizes artificial intelligence desktop software management through the interaction between the cloud server and the cloud desktop.

[0093] In the specific implementation process of the present invention, the specific implementation methods of the system items can be referred to the above embodiments, which will not be repeated here.

[0094] In an embodiment of the present invention, the usage of several desktop software is classified based on the total running frequency, total usage time and total opening times calculated from the usage data, avoiding the one-sidedness caused by the usage classification based on a single factor, and improving the accuracy of the usage classification of desktop software. The commonly used desktop software is classified according to the classification model generated by the clustering label, and then the commonly used desktop software of each category is sorted and arranged in the cloud desktop based on the user's usage habit data, so that the commonly used desktop software sorted and arranged in the cloud desktop is more in line with the user's usage habits, allowing users to quickly find the desktop software they need, and improving the user's operating experience. Based on the attack state library, the vulnerability risk analysis is combined with the operation log data to perform security risk assessment on the uncommon desktop software and the commonly used desktop software after sorting and layout, which can more comprehensively and accurately evaluate the security of the software, avoid the deviation between the obtained security risk assessment results and the actual situation, and ensure the safe operation of the desktop software. Based on the security risk assessment results, the search tree is used to determine the target security policy corresponding to the uncommon desktop software and the commonly used desktop software after sorting and layout in several non-redundant security policies, which can more quickly and accurately search for the required security policy and ensure the reliability of the security protection of the desktop software. When each desktop software is in the running state for security protection, it can determine whether hot addition of computing resources is needed based on the resource load situation, so as to ensure the timeliness and accuracy of cloud desktop resource allocation, avoid desktop software jams or even crashes, and store running data in the corresponding hot and cold storage nodes to avoid waste of storage resources, so that desktop software management can achieve more ideal results and realize artificial intelligence-based desktop software management.

[0095] Embodiment 4

[0096] See also Figure 4 , Figure 4 : is a schematic diagram of the structure of a desktop software management device based on a database in an embodiment of the present invention, the device is applied to a cloud desktop and a cloud server, the cloud server is deployed with an artificial intelligence engine, and the cloud desktop is communicatively connected with the cloud server; the device includes:

[0097] Software usage classification module 41: used to obtain usage data and operation log data of several desktop software of the cloud desktop in each time period from the database of the cloud server, and the artificial intelligence engine classifies the usage of several desktop software based on the usage data to obtain several commonly used desktop software and infrequently used desktop software;

[0098] The software sorting and layout module 42 is used to obtain the user usage habit data of several commonly used desktop software in the database, and sort and layout the several commonly used desktop software in the cloud desktop based on the user usage habit data to obtain the commonly used desktop software after sorting and layout;

[0099] Software security risk assessment module 43: used to construct an attack status library, and to perform security risk assessment on the uncommon desktop software and the sorted and arranged common desktop software based on the attack status library using vulnerability risk analysis combined with the operation log data, to obtain corresponding security risk assessment results;

[0100] Software security protection module 44: used to obtain a plurality of non-redundant security policies, determine a target security policy corresponding to the uncommon desktop software and the sorted and arranged common desktop software from the plurality of non-redundant security policies based on the security risk assessment result, and perform security protection on the uncommon desktop software and the sorted and arranged common desktop software based on the target security policy;

[0101] Resource allocation and data storage module 45: used to obtain the resource load status and operation data when the uncommon desktop software and the commonly used desktop software after sorting and layout are used for security protection, and adjust the resource allocation of the cloud desktop based on the resource load status, and store the operation data in the corresponding storage node of the database.

[0102] In the specific implementation process of the present invention, the specific implementation method of the device item can refer to the implementation method of the above-mentioned method item, which will not be repeated here.

[0103] In an embodiment of the present invention, the usage of several desktop software is classified based on the total running frequency, total usage time and total opening times calculated from the usage data, avoiding the one-sidedness caused by the usage classification based on a single factor, and improving the accuracy of the usage classification of desktop software. The commonly used desktop software is classified according to the classification model generated by the clustering label, and then the commonly used desktop software of each category is sorted and arranged in the cloud desktop based on the user's usage habit data, so that the commonly used desktop software sorted and arranged in the cloud desktop is more in line with the user's usage habits, allowing users to quickly find the desktop software they need, and improving the user's operating experience. Based on the attack state library, the vulnerability risk analysis is combined with the operation log data to perform security risk assessment on the uncommon desktop software and the commonly used desktop software after sorting and layout, which can more comprehensively and accurately evaluate the security of the software, avoid the deviation between the obtained security risk assessment results and the actual situation, and ensure the safe operation of the desktop software. Based on the security risk assessment results, the search tree is used to determine the target security policy corresponding to the uncommon desktop software and the commonly used desktop software after sorting and layout in several non-redundant security policies, which can more quickly and accurately search for the required security policy and ensure the reliability of the security protection of the desktop software. When each desktop software is in the running state for security protection, it can determine whether hot addition of computing resources is needed based on the resource load situation, so as to ensure the timeliness and accuracy of cloud desktop resource allocation, avoid desktop software jams or even crashes, and store running data in the corresponding hot and cold storage nodes to avoid waste of storage resources, so that desktop software management can achieve more ideal results and realize artificial intelligence-based desktop software management.

[0104] A person skilled in the art may understand that all or part of the steps in the various methods of the above embodiments may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, and the storage medium may include: a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, etc.

[0105] In addition, the above is a detailed introduction to a database-based desktop software management method and related devices provided by an embodiment of the present invention. Specific examples are used herein to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for a person skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

Claims

1. A desktop software management method based on a database, characterized in that: Applied to a cloud desktop and a cloud server, the cloud server is deployed with an artificial intelligence engine, and the cloud desktop is communicatively connected with the cloud server; the method comprises: Obtaining usage data and operation log data of several desktop software of the cloud desktop in each time period from the database of the cloud server, and classifying the usage of several desktop software based on the usage data by the artificial intelligence engine to obtain several commonly used desktop software and infrequently used desktop software; Obtaining user usage habit data of several commonly used desktop software in a database, and sorting and arranging the several commonly used desktop software in a cloud desktop based on the user usage habit data, to obtain the sorted and arranged commonly used desktop software; Construct an attack status library, and perform security risk assessment on the uncommon desktop software and the sorted and arranged common desktop software based on the attack status library using vulnerability risk analysis combined with the operation log data to obtain corresponding security risk assessment results; Acquire a plurality of non-redundant security policies, determine a target security policy corresponding to the uncommonly used desktop software and the sorted and arranged common desktop software from the plurality of non-redundant security policies based on the security risk assessment result, and perform security protection on the uncommonly used desktop software and the sorted and arranged common desktop software based on the target security policy; Obtaining resource load conditions and operation data when the uncommon desktop software and the sorted and arranged common desktop software are protected, adjusting resource allocation of the cloud desktop based on the resource load conditions, and storing the operation data in a corresponding storage node of the database; The construction of the attack state library includes: obtaining historical attack behavior information and historical security state information sets, and constructing an attack state diagram based on the historical attack behavior information and historical security state information sets; calculating the state transition probability of the attack state diagram based on the attack and defense game matrix, and constructing the attack state library based on the state transition probability combined with the historical attack path; The obtaining of a plurality of non-redundant security policies comprises: obtaining all security policies, comparing two adjacent security policies in sequence according to the arrangement order of all security policies, and obtaining a comparison result; determining redundant security policies among all security policies based on the comparison result, and deleting redundant security policies among all security policies in sequence, and obtaining a plurality of non-redundant security policies; The classifying the usage of the plurality of desktop software based on the usage data to obtain a plurality of commonly used desktop software and infrequently used desktop software includes: calculating the total running frequency, total usage time and total opening times of each desktop software based on the usage data, and calculating the common score of each desktop software based on the total running frequency, total usage time and total opening times; comparing the common score with a preset threshold to obtain a comparison result, and classifying the usage of the plurality of desktop software based on the comparison result to obtain a plurality of commonly used desktop software and infrequently used desktop software; The method of sorting and arranging a number of commonly used desktop software in a cloud desktop based on the user usage habit data to obtain the commonly used desktop software after sorting and arranging includes: obtaining candidate label information corresponding to sample desktop software, and determining a candidate label information vector of each candidate label information, clustering based on the candidate label information vector, and obtaining a number of candidate label information clusters; constructing a corresponding cluster label for each candidate label information cluster, obtaining a classification model based on the cluster label, and classifying a number of commonly used desktop software based on the classification model to obtain commonly used desktop software of each category; extracting a number of usage order information of commonly used desktop software of each category based on the user usage habit data, counting the frequency of the usage order information, and determining the target software ranking based on the frequency of the usage order information combined with a weighted multi-branch tree; sorting and arranging the commonly used desktop software of each category in the cloud desktop based on the target software ranking to obtain the commonly used desktop software after sorting and arranging; The method of performing security risk assessment on the uncommon desktop software and the commonly used desktop software after sorting and layout based on the attack status library using vulnerability risk analysis in combination with the operation log data to obtain corresponding security risk assessment results includes: extracting log feature data from the operation log data, and identifying attack behaviors of the uncommon desktop software and the commonly used desktop software after sorting and layout based on the attack status library in combination with the log feature data to obtain attack behavior identification results; extracting software package information from the operation log data, and detecting vulnerability risks of the uncommon desktop software and the commonly used desktop software after sorting and layout based on the software package information using a software dependency network; and performing security risk assessment on the uncommon desktop software and the commonly used desktop software after sorting and layout based on the attack behavior identification results and vulnerability risks to obtain corresponding security risk assessment results.

2. The desktop software management method based on database according to claim 1, characterized in that: The step of determining a target security policy corresponding to the uncommon desktop software and the sorted and arranged common desktop software from among a plurality of non-redundant security policies based on the security risk assessment result includes: Based on the security risk assessment result, a search tree is used to perform policy matching between the uncommon desktop software and the sorted and arranged common desktop software in a plurality of non-redundant security policies to determine a corresponding target security policy.

3. The desktop software management method based on database according to claim 1, characterized in that: The adjusting the resource allocation of the cloud desktop based on the resource load condition and storing the running data in a corresponding storage node of the database includes: Determine whether the resource load of the uncommon desktop software and the arranged common desktop software during security protection is greater than a preset load threshold baseline, and if the resource load is greater than the preset load threshold baseline, perform hot addition of computing resources on the cloud desktop; The operation data is divided into necessary operation data and non-essential operation data, the necessary operation data is stored in a hot storage node of a database, and the non-essential operation data is stored in a cold storage node of the database.

4. A desktop software management device based on a database, characterized in that: Applied to a cloud desktop and a cloud server, the cloud server is deployed with an artificial intelligence engine, and the cloud desktop is communicatively connected with the cloud server; the device comprises: Software usage classification module: used to obtain usage data and operation log data of several desktop software of the cloud desktop in each time period from the database of the cloud server, and the artificial intelligence engine classifies the usage of several desktop software based on the usage data to obtain several commonly used desktop software and infrequently used desktop software; Software sorting and layout module: used to obtain user usage habit data of several commonly used desktop software in the database, and sort and layout several commonly used desktop software in the cloud desktop based on the user usage habit data to obtain the commonly used desktop software after sorting and layout; Software security risk assessment module: used to build an attack status library, and based on the attack status library, perform security risk assessment on the uncommon desktop software and the sorted and arranged common desktop software using vulnerability risk analysis combined with the operation log data to obtain corresponding security risk assessment results; Software security protection module: used to obtain a plurality of non-redundant security policies, determine a target security policy corresponding to the uncommon desktop software and the sorted and arranged common desktop software from the plurality of non-redundant security policies based on the security risk assessment result, and perform security protection on the uncommon desktop software and the sorted and arranged common desktop software based on the target security policy; Resource allocation and data storage module: used to obtain the resource load and operation data of the uncommon desktop software and the commonly used desktop software after sorting and layout when performing security protection, and adjust the resource allocation of the cloud desktop based on the resource load, and store the operation data in the corresponding storage node of the database; The construction of the attack state library includes: obtaining historical attack behavior information and historical security state information sets, and constructing an attack state diagram based on the historical attack behavior information and historical security state information sets; calculating the state transition probability of the attack state diagram based on the attack and defense game matrix, and constructing the attack state library based on the state transition probability combined with the historical attack path; The obtaining of a plurality of non-redundant security policies comprises: obtaining all security policies, comparing two adjacent security policies in sequence according to the arrangement order of all security policies, and obtaining a comparison result; determining redundant security policies among all security policies based on the comparison result, and deleting redundant security policies among all security policies in sequence, and obtaining a plurality of non-redundant security policies; The classifying the usage of the plurality of desktop software based on the usage data to obtain a plurality of commonly used desktop software and infrequently used desktop software includes: calculating the total running frequency, total usage time and total opening times of each desktop software based on the usage data, and calculating the common score of each desktop software based on the total running frequency, total usage time and total opening times; comparing the common score with a preset threshold to obtain a comparison result, and classifying the usage of the plurality of desktop software based on the comparison result to obtain a plurality of commonly used desktop software and infrequently used desktop software; The method of sorting and arranging a number of commonly used desktop software in a cloud desktop based on the user usage habit data to obtain the commonly used desktop software after sorting and arranging includes: obtaining candidate label information corresponding to sample desktop software, and determining a candidate label information vector of each candidate label information, clustering based on the candidate label information vector, and obtaining a number of candidate label information clusters; constructing a corresponding cluster label for each candidate label information cluster, obtaining a classification model based on the cluster label, and classifying a number of commonly used desktop software based on the classification model to obtain commonly used desktop software of each category; extracting a number of usage order information of commonly used desktop software of each category based on the user usage habit data, counting the frequency of the usage order information, and determining the target software ranking based on the frequency of the usage order information combined with a weighted multi-branch tree; sorting and arranging the commonly used desktop software of each category in the cloud desktop based on the target software ranking to obtain the commonly used desktop software after sorting and arranging; The method of performing security risk assessment on the uncommon desktop software and the commonly used desktop software after sorting and layout based on the attack status library using vulnerability risk analysis in combination with the operation log data to obtain corresponding security risk assessment results includes: extracting log feature data from the operation log data, and identifying attack behaviors of the uncommon desktop software and the commonly used desktop software after sorting and layout based on the attack status library in combination with the log feature data to obtain attack behavior identification results; extracting software package information from the operation log data, and detecting vulnerability risks of the uncommon desktop software and the commonly used desktop software after sorting and layout based on the software package information using a software dependency network; and performing security risk assessment on the uncommon desktop software and the commonly used desktop software after sorting and layout based on the attack behavior identification results and vulnerability risks to obtain corresponding security risk assessment results.

5. A desktop software management system based on a database, characterized in that: The system includes a cloud desktop and a cloud server, the cloud server is deployed with an artificial intelligence engine, the cloud desktop is communicatively connected to the cloud server, and the system is configured to execute the database-based desktop software management method described in any one of claims 1 to 3.

Images