Data security intelligent risk early warning method based on time series data

Abstract

The invention discloses a data security intelligent risk early warning method based on time series data, and relates to the technical field of data security, and the method comprises the steps: firstly, carrying out the matching of behavior data of a user based on a rule strategy library through a first risk detection unit, and carrying out the initial risk judgment; on the basis that the matching of the first risk detection unit is not successful, a second risk detection unit identifies and constructs a user portrait based on user data under the same sessionid, and performs secondary anomaly judgment in combination with service data in a second analysis result; and on the basis of judging that a normal user outputs a fourth analysis result, a third risk detection unit carries out similar association analysis judgment according to the second type of risk information in combination with a rule strategy in a rule strategy library, and carries out final risk judgment on a user behavior. Risk judgment is carried out on user behaviors on the basis of the first risk detection unit, the second risk detection unit and the third risk detection unit, and the accuracy rate of early warning of abnormal users is increased.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and specifically to a data security intelligent risk early warning method based on time series data. Background Art

[0002] Research on abnormal user warning methods based on graph neural networks, accurately and efficiently discovering abnormal users and abnormal behavior traces from a large amount of data is the core key to internal threat detection. Abnormal user warning technology has experienced a development process from early solutions based on rules and thresholds to the current development based on user behavior profile deviations. At present, supervised technology based on machine learning and deep learning technology has become the mainstream method for identifying user behavior deviations to classify abnormal users, but this type of method often requires a large amount of labeled data support and has weak generalization capabilities for new attack methods. Although unsupervised methods have a weaker dependence on labeled samples, their accuracy is not high.

[0003] Current scene recognition and association analysis technologies are mainly based on probability models, visualization, and graphs. However, the construction of probability models requires high professional skills and is difficult to maintain, and visualization methods lack association reasoning capabilities. Graph methods based on attack graphs or scenario trees can combine the advantages of visualization methods and probability model methods, but the high computational complexity of graphs often prevents them from being applied in large-scale network structures. To address the above issues, we deepen the identification and association analysis of internal threat scenarios based on frequent item mining and threat scenario feature tree association algorithms. First, all threat scenarios and the key feature sets that constitute threat scenarios are mined from the historical case library and the portrait feature library according to the frequent item mining algorithm. Then, the primary alarm user behavior and the mined threat scenarios are associated and filtered to produce the final decision.

[0004] To this end, we design and implement a user abnormal behavior classification model by combining a semi-supervised learning method - graph convolutional neural network. This model can learn the user behavior abnormality classification weights based on the characteristics of some known abnormal users and the correlation between users. On the one hand, it can mine and predict potential threat users as much as possible. On the other hand, it can also improve the accuracy of abnormal user warning in an environment without annotations, and provide accurate preliminary detection results for subsequent related decisions. Summary of the invention

[0005] In view of the deficiencies in the prior art, the present invention provides a data security intelligent risk warning method based on time series data, which solves the problem that the original data security inspection and warning process is not comprehensive.

[0006] To achieve the above objectives, the present invention is implemented through the following technical solutions: a data security intelligent risk early warning method based on time series data, comprising the following steps:

[0007] S1) Record the initiator, operation time, operation object, operation type, and two-way audit dimension of the operation through the database audit log, where the initiator is the client with the relevant IP or port, and the first risk detection unit matches the captured and parsed behavior data with the rule policy library. If the match is successful, the first analysis result is output, and if the match fails, the second analysis result is output;

[0008] S2), on the premise that the first risk detection unit outputs the second analysis result, the second risk detection unit identifies the user data under the same sessionid and constructs a user portrait, and makes an abnormal judgment on the user based on the constructed user portrait combined with the business data contained in the second analysis result. If the user is an abnormal user, the second risk detection unit outputs a third analysis result, and generates a second type of risk warning information based on the third analysis result, and makes an intelligent warning based on the second type of risk warning information. If the user is a normal user, the fourth analysis result is output;

[0009] S3), on the premise that the second risk detection unit generates the second type of risk warning information, the third risk detection unit performs similarity association analysis and judgment based on the second type of risk information combined with the rule strategy in the rule strategy library, inputs the judgment result into the preset threat feature model to output the fifth analysis result, and the third risk detection unit generates the third type of risk warning information based on the fifth analysis result, performs intelligent warning based on the third type of risk warning information, and generates potential threat association analysis rules;

[0010] S4) clustering the results of the first, second and third risk warning information, building a user behavior profile within a preset period based on the time dimension, observing the development and change of data relatively steadily over a continuous period of time according to the characteristics of data time dependency, and generating the first risk warning information if the observation data collected at the current time point or time period has undergone a significant change, and performing intelligent warning based on the first risk warning information;

[0011] S5), performing result cluster analysis on the first type of risk warning information, the second type of risk warning information and the third type of risk warning information, analyzing from different dimensions, and generating new security policy rules.

[0012] Preferably, in step S1, the specific method of recording includes:

[0013] Obtain basic user operation behaviors based on the existing rule base;

[0014] Business data is sorted according to the audit log, and the business data is matched with the rules and policies in the rule and policy library; the rule and policies mainly include: database attack policy, risk access policy, potential threat policy, and only a single audit data anomaly is matched here. If the match is successful, the first analysis result is output, and the first analysis result contains the matching rules and policies. The first type of risk warning information is generated according to the first analysis result, and intelligent warning is performed according to the first type of risk warning information;

[0015] Otherwise, the business data that failed to match will be summarized and output as the second analysis result for further learning and user profiling.

[0016] Preferably, the early warning method is operated based on a relevant early warning system, which includes:

[0017] The first risk detection unit captures and analyzes the behavior data, matches it with the rule base, confirms the first analysis result, and outputs the second analysis result if it cannot match; obtains the basic user operation behavior based on the existing rule base;

[0018] The second risk detection unit, on the premise that the first risk detection unit outputs the second analysis result, identifies the user data under the same sessionid to obtain a user portrait, and makes an abnormal judgment on the user based on the constructed user portrait and the business data contained in the second analysis result. If the user is an abnormal user, the second risk detection unit outputs a third analysis result, generates a second type of risk warning information based on the third analysis result, and makes an intelligent warning based on the second type of risk warning information. If the user is a normal user, the fourth analysis result is output;

[0019] The third risk detection unit, under the premise that the second risk detection unit outputs the second type of risk warning information, performs similarity association analysis and determination based on the second type of risk information combined with the rule strategy in the rule strategy library, inputs the determination result into the preset threat feature model to output a fifth analysis result, and the third risk detection unit generates the third type of risk warning information based on the fifth analysis result, and performs intelligent warning based on the third type of risk warning information;

[0020] The first, second and third risk warning information are clustered and analyzed from different dimensions to generate new security policy rules.

[0021] At the same time, the second analysis result output by the first risk detection unit and the fourth analysis result output by the second risk detection unit are combined to perform unknown risk mining, and a user behavior portrait is constructed within a certain period based on the time dimension. According to the characteristics of data time dependence, the development and changes of observation data in a continuous period of time are relatively stable. If an abnormality occurs, its intuitive manifestation is that if an intuitive abnormality occurs in the change, in this embodiment, the observation data collected at the current time point or time period has undergone a large change, then the first type of risk warning information is generated, and intelligent warning is performed based on the first type of risk warning information.

[0022] The present invention provides a data security intelligent risk early warning method based on time series data. Compared with the prior art, it has the following beneficial effects:

[0023] (1) The present invention first matches the user's behavior data based on the rule policy library through the first risk detection unit, and performs an initial risk judgment on the user's behavior. On the basis that the first risk detection unit fails to match the rule policy library, the second risk detection unit identifies and constructs a user portrait based on the user data under the same session ID, and performs a secondary abnormality judgment in combination with the business data contained in the second analysis result. On the basis of the second risk detection unit determining that the user is normal and outputting the fourth analysis result, the third risk detection unit performs a similarity association analysis and judgment based on the second type of risk information and the rule policy in the rule policy library, and performs a final risk judgment on the user's behavior based on the judgment result. In this way, the risk judgment of the user's behavior is performed on the basis of the first risk detection unit, the second risk detection unit and the third risk detection unit, thereby increasing the accuracy of the abnormal user warning.

[0024] (2) The present invention constructs a user's behavior profile within a preset time period based on the time dimension, and observes the development and changes of data in a continuous period of time according to the characteristics of data time dependence. The first type of risk warning information is generated based on the observation data collected at a time point or time period, and is used to conduct risk warning. In this way, potential risk signs can be captured in a timely manner, greatly improving the timeliness and accuracy of risk prevention and control;

[0025] (3) The present invention analyzes from the following different dimensions, such as client dimension, target database dimension, operation object dimension, operation type dimension, and two-way audit dimension, based on the time dimension, in order to generate new intelligent early warning and disposal security policy rules, and obtain business knowledge from different dimensions through self-learning process of custom rule policy library to organize early warning and disposal baseline strategies, generate new security policy rules, fully guarantee the data security issues in the later stage, and visualize the clustering results to better understand and explain the clustering effect; extract and recommend some candidate new early warning rules. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 It is a schematic diagram of the process of the present invention. DETAILED DESCRIPTION

[0027] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0028] See also Figure 1 , this application provides a data security intelligent risk warning method based on time series data, including the following steps:

[0029] S1) The first risk detection unit performs audit analysis based on the data security policy library:

[0030] The audit log of the database records the initiator, operation time, operation object, operation type, two-way audit and other dimensions of the operation. The initiator is the client with the relevant IP or port:

[0031] Obtain basic user operation behaviors based on the existing rule policy library: Here, we mainly analyze single parsed data;

[0032] The first risk detection unit matches the captured and parsed behavior data with the rule policy library, and outputs a first analysis result if the match is successful, or a second analysis result if the match fails;

[0033] The more detailed processing methods are as follows:

[0034] Organizing business data according to the audit log, and matching the business data with the rules and policies in the rule and policy library;

[0035] The rule strategies mainly include: database attack strategy (SQL attack), risk access strategy (built-in), potential threat strategy (abnormal login, weak password, user privilege escalation, export theft, successful execution, etc.). Here, only a single audit data anomaly is matched. If the match is successful, the first analysis result is output. The first analysis result contains the matching rule strategy. The first type of risk warning information is generated according to the first analysis result, and intelligent warning is performed according to the first type of risk warning information.

[0036] Otherwise, the business data that failed to match will be summarized and output as the second analysis result for further learning and user profiling.

[0037] S2), when the first risk detection unit outputs the second analysis result, the second risk detection unit identifies and analyzes the user data under the same sessionid, constructs a user portrait that can reflect the user's characteristics and behaviors, and makes an abnormal judgment on the user based on the constructed user portrait combined with the business data contained in the second analysis result. If the user is an abnormal user, the second risk detection unit outputs a third analysis result, generates a second type of risk warning information based on the third analysis result, and makes an intelligent warning based on the second type of risk warning information. If the user is a normal user, a fourth analysis result is output, wherein the construction of the user portrait is constructed in combination with a database user abnormal behavior detection method based on a graph neural network model;

[0038] Research on abnormal behavior detection methods for database users based on graph neural network models. Accurately and efficiently discovering abnormal users and abnormal behavior traces from a large amount of data is the core key to internal threat detection. Abnormal user warning technology has experienced a development process from the early scheme based on rules and thresholds to the current one based on user behavior profile deviation. At present, supervised technology based on machine learning and deep learning technology has become the mainstream method for identifying user behavior deviations to classify abnormal users, but this type of method often requires a large amount of labeled data support and has weak generalization ability for new attack methods. Although unsupervised methods have weak dependence on labeled samples, their accuracy is not high. For this reason, a user abnormal behavior classification model is designed and implemented in combination with a semi-supervised learning method-graph convolutional neural network. It can learn the user behavior abnormal classification weights based on the characteristics of some known abnormal users and the association between users. On the one hand, it can mine and predict potential threat users as much as possible, and on the other hand, it can also improve the accuracy of abnormal user warnings in an environment without annotations, and provide accurate primary detection results for subsequent association decisions;

[0039] S3), a third risk detection unit is used to perform similarity association analysis and judgment based on the second type of risk information in combination with the rule strategy in the rule strategy library, input the judgment result into the preset threat feature model to output the fifth analysis result, and the third risk detection unit generates the third type of risk warning information based on the fifth analysis result, and performs intelligent warning based on the third type of risk warning information:

[0040] Research on complex internal threat scenario identification and association analysis technology, abnormal behavior does not represent threat behavior. Research on internal threat scenario identification and association analysis aims to combine information such as primary alarms, original behaviors, case libraries, and feature libraries to perform high-level detection and mining of potential threat users and threat scenarios. Current scenario identification and association analysis technologies are mainly based on probability models, visualization, and graphs, but the construction of probability models requires high professional skills and is difficult to maintain, and visualization methods lack association reasoning capabilities. Graph methods based on attack graphs or scenario trees can combine the advantages of visualization methods and probability model methods, but the high computational complexity of graphs often makes them inapplicable in large-scale network structures. In response to the above problems, the identification and association analysis of internal threat scenarios is deepened based on frequent item mining and threat scenario feature tree association algorithms. First, all threat scenarios and the key feature sets that constitute threat scenarios are mined from the historical case library and the portrait feature library according to the frequent item mining algorithm. Then, the primary alarm user behavior and the mined threat scenarios are associated and filtered to produce the final decision;

[0041] S4), performing cluster analysis on the first type of risk warning information, the second type of risk warning information and the third type of risk warning information, constructing a user behavior profile within a preset period based on the time dimension, and observing the development and change of the data relatively smoothly over a continuous period of time according to the characteristics of data time dependency. If an intuitive anomaly occurs in the change, which in this embodiment is manifested as a significant change in the observation data collected at the current time point or time period, the first type of risk warning information is generated, and intelligent warning is performed based on the first type of risk warning information;

[0042] At the same time, analysis is performed from the above different dimensions (client dimension, target database dimension, time dimension, operation object dimension, operation type dimension, two-way audit dimension, etc.) to generate new security policy rules; (cluster analysis, generate new security policy rules):

[0043] The first type of risk warning information, the second type of risk warning information, the third type of risk warning information and the results of the first three analysis templates are organized into new business baseline policies through self-learning and added to the custom rule policy library. The baseline policies are organized by acquiring business knowledge from different dimensions (client dimension, target database dimension, time dimension, operation object dimension, operation type dimension, two-way audit dimension, etc.) through the self-learning process of the custom rule policy library, aiming to provide users with new security policy rules for generation.

[0044] The operation initiators of the database audit log include: client IP, client access port number and session ID;

[0045] The client dimensions include: client IP (core); client access port number (auxiliary); session ID (auxiliary); client tools; client operating system; client operating system host name; and may also involve: client machine MAC address, client host name.

[0046] The target database dimensions include: database login user name (core), database IP address; database type; database port number; and may also involve: database MAC address.

[0047] Among them, the time dimension includes the time when the client initiates the request (core);

[0048] The operation object dimension includes the operation object type (server "SERVER", database "DATABASE", library table "TABLE", view "VI EW", record "DATA", field "FI ELD", stored procedure "PROC", function "FUNC", trigger "TRIGGER", index "I NDEX", event "EVENT", other "UNKNOW"); database name; library table name; field name; and may also involve: view, trigger, function, index, event, etc.

[0049] Among them, the operation type dimension is:

[0050] Operation type (data definition language "DDL", data query language "DQL", data manipulation language "DML", data transaction language "DTL", data control language "DCL", other operations "OTH");

[0051] Operation name;

[0052] Operation content;

[0053] It may also involve: execution conditions, etc.

[0054] Two-way audit dimension:

[0055] SQL execution time;

[0056] SQL execution result status;

[0057] The number of items affected by the SQL statement execution;

[0058] It may also involve: SQL execution feedback results.

[0059] To sum up, intelligent early warning based on risk warning information of time series data can be simplified as follows:

[0060] Based on the risk warning information, some candidate rules are automatically extracted through the time series data clustering algorithm: Deep learning methods such as LSTM, GRU, etc. can also be used for time series data clustering. Through the result clustering analysis of the first type of risk warning information, the second type of risk warning information and the third type of risk warning information, based on the time dimension, the following different dimensions are analyzed from the client dimension, the target database dimension, the operation object dimension, the operation type dimension, the two-way audit dimension, etc., in order to generate new intelligent warning and disposal security policy rules. Through the self-learning process of the custom rule policy library from different dimensions, the business knowledge is obtained to organize the warning and disposal baseline strategy, which is intended for users to generate new security policy rules.

[0061] First, collect database access time series data: including user ID, timestamp, SQL query and other information. Organize the time series data into a format suitable for LSTM, such as selecting appropriate time steps, features, etc. Perform preprocessing steps such as data cleaning, missing value processing and standardization.

[0062] Then build the LSTM model: consider the appropriate model structure and hyperparameters. After training, extract the hidden layer output of the LSTM model as the embedding vector of each time series data point. Use the extracted embedding vector for clustering and select an appropriate clustering algorithm (such as K-means, hierarchical clustering, DBSCAN, etc.).

[0063] Finally, the clustering results are visualized to better understand and explain the clustering effect. Some candidate new warning rules are extracted and recommended.

[0064] The data security intelligent risk early warning method based on time series data is operated based on a relevant early warning system, and the early warning system includes:

[0065] The first risk detection unit captures and analyzes the behavior data, matches it with the rule base, confirms the first analysis result, and outputs the second analysis result if it cannot match; obtains the basic user operation behavior based on the existing rule base;

[0066] The second risk detection unit, on the premise that the first risk detection unit outputs the second analysis result, identifies the user data under the same sessionid to obtain a user portrait, and makes an abnormal judgment on the user based on the constructed user portrait and the business data contained in the second analysis result. If the user is an abnormal user, the second risk detection unit outputs a third analysis result, generates a second type of risk warning information based on the third analysis result, and makes an intelligent warning based on the second type of risk warning information. If the user is a normal user, the fourth analysis result is output;

[0067] The third risk detection unit, under the premise that the second risk detection unit outputs the second type of risk warning information, performs similarity association analysis and determination based on the second type of risk information combined with the rule strategy in the rule strategy library, inputs the determination result into the preset threat feature model to output a fifth analysis result, and the third risk detection unit generates the third type of risk warning information based on the fifth analysis result, and performs intelligent warning based on the third type of risk warning information;

[0068] The first, second and third risk warning information are clustered and analyzed from different dimensions to generate new security policy rules.

[0069] At the same time, the second analysis result output by the first risk detection unit and the fourth analysis result output by the second risk detection unit are combined to perform unknown risk mining, and a user behavior portrait is constructed within a certain period based on the time dimension. According to the characteristics of data time dependence, the development and changes of observation data in a continuous period of time are relatively stable. If an abnormality occurs, its intuitive manifestation is that if an intuitive abnormality occurs in the change, in this embodiment, the observation data collected at the current time point or time period has undergone a large change, then the first type of risk warning information is generated, and intelligent warning is performed based on the first type of risk warning information.

[0070] Some of the data in the above formulas are dimensionless and numerically calculated. Meanwhile, the contents not described in detail in this specification belong to the prior art known to those skilled in the art.

[0071] The above embodiments are only used to illustrate the technical method of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical method of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical method of the present invention.

Claims

1. Data security intelligent risk warning method based on time series data, It is characterized in that The following steps are involved: S1) Record the initiator, operation time, operation object, operation type, and two-way audit dimension of the operation through the database audit log, where the initiator is the client with the relevant IP or port, and the first risk detection unit matches the captured and parsed behavior data with the rule policy library. If the match is successful, the first analysis result is output, and if the match fails, the second analysis result is output; S2), on the premise that the first risk detection unit outputs the second analysis result, the second risk detection unit identifies the user data under the same sessionid and constructs a user profile, and makes an abnormal judgment on the user based on the constructed user profile combined with the business data contained in the second analysis result. If the user is an abnormal user, the second risk detection unit outputs a third analysis result, and generates a second type of risk warning information based on the third analysis result, and makes an intelligent warning based on the second type of risk warning information. If the user is a normal user, the fourth analysis result is output; S3), on the premise that the second risk detection unit generates the second type of risk warning information, the third risk detection unit performs similarity association analysis and judgment based on the second type of risk information combined with the rule strategy in the rule strategy library, inputs the judgment result into the preset threat feature model to output the fifth analysis result, and the third risk detection unit generates the third type of risk warning information based on the fifth analysis result, performs intelligent warning based on the third type of risk warning information, and generates potential threat association analysis rules; S4) clustering the results of the first, second and third risk warning information, building a user behavior profile within a preset period based on the time dimension, observing the development and change of data relatively steadily over a continuous period of time according to the characteristics of data time dependency, and generating the first risk warning information if the observation data collected at the current time point or time period has undergone a significant change, and performing intelligent warning based on the first risk warning information; S5), performing result cluster analysis on the first type of risk warning information, the second type of risk warning information and the third type of risk warning information, analyzing from different dimensions, and generating new security policy rules.

2. According to claim 1, the data security intelligent risk early warning method based on time series data, It is characterized in that In step S1, the specific method of recording includes: Obtain basic user operation behaviors based on the existing rule base; Business data is sorted according to the audit log, and the business data is matched with the rules and policies in the rule and policy library; the rule and policies mainly include: database attack policy, risk access policy, potential threat policy, and only a single audit data anomaly is matched here. If the match is successful, the first analysis result is output, and the first analysis result contains the matching rules and policies. The first type of risk warning information is generated according to the first analysis result, and intelligent warning is performed according to the first type of risk warning information; Otherwise, the business data that failed to match will be summarized and output as the second analysis result for further learning and user profiling.

3. According to claim 1, the data security intelligent risk early warning method based on time series data, It is characterized in that In the step S2, a semi-supervised learning method, graph convolutional neural network, is used to design and implement a classification model for abnormal user behavior when identifying user portraits, and the user behavior abnormality classification weights are learned based on the characteristics of some known abnormal users and the associations between users.

4. According to claim 1, the data security intelligent risk early warning method based on time series data, It is characterized in that In step S3, firstly, all threat scenarios and key feature sets constituting threat scenarios are mined from the historical case library and the portrait feature library according to the frequent item mining algorithm, the primary alarm user behavior and the mined threat scenarios are associated and filtered, and potential threat association analysis rules are generated.

5. According to claim 1, the data security intelligent risk early warning method based on time series data, It is characterized in that In the step S5, the first type of risk warning information, the second type of risk warning information, the third type of risk warning information and the first three analysis template results are organized into a new business baseline strategy through self-learning and added to the custom rule policy library. The baseline strategy is organized by acquiring business knowledge through the self-learning process of the custom rule policy library from different dimensions, and is intended for users to generate new security policy rules.

6. According to claim 5, the data security intelligent risk early warning method based on time series data, It is characterized in that The different dimensions include: Client dimension, target database dimension, time dimension, operation object dimension, operation type dimension, and bidirectional audit dimension.

7. According to claim 1, the data security intelligent risk early warning method based on time series data, It is characterized in that The early warning method operates based on a relevant early warning system, which includes: The first risk detection unit captures and analyzes the behavior data, matches it with the rule base, confirms the first analysis result, and outputs the second analysis result if it cannot match; obtains the basic user operation behavior based on the existing rule base; The second risk detection unit, on the premise that the first risk detection unit outputs the second analysis result, identifies the user data under the same sessionid to obtain a user portrait, and makes an abnormal judgment on the user based on the constructed user portrait and the business data contained in the second analysis result. If the user is an abnormal user, the second risk detection unit outputs a third analysis result, generates a second type of risk warning information based on the third analysis result, and makes an intelligent warning based on the second type of risk warning information. If the user is a normal user, the fourth analysis result is output; The third risk detection unit, under the premise that the second risk detection unit outputs the second type of risk warning information, performs similarity association analysis and determination based on the second type of risk information combined with the rule strategy in the rule strategy library, inputs the determination result into the preset threat feature model to output a fifth analysis result, and the third risk detection unit generates the third type of risk warning information based on the fifth analysis result, and performs intelligent warning based on the third type of risk warning information; The first, second and third risk warning information are clustered and analyzed from different dimensions to generate new security policy rules. At the same time, the second analysis result output by the first risk detection unit and the fourth analysis result output by the second risk detection unit are combined to perform unknown risk mining, and a user behavior portrait is constructed within a certain period based on the time dimension. According to the characteristics of data time dependence, the development and changes of observation data in a continuous period of time are relatively stable. If an abnormality occurs, its intuitive manifestation is that if an intuitive abnormality occurs in the change, in this embodiment, the observation data collected at the current time point or time period has undergone a large change, then the first type of risk warning information is generated, and intelligent warning is performed based on the first type of risk warning information.

Images