Large model-based server monitoring method and security monitoring early warning platform

Abstract

The invention provides a server monitoring method based on a large model and a security monitoring early warning platform. Client sides are installed in all the servers needing to be monitored respectively; the security monitoring and early warning platform collects the performance index of the server by using the client in the server, and monitors the running state and running data of the server according to the collected performance index of the server; the security monitoring and early warning platform performs state monitoring on the application service and the business program service running on the server by using the client in the server; and the security monitoring and early warning platform pulls the business program data through the API interface, inputs the pulled business program data into a pre-trained large model, and finds abnormal behaviors and foresees a data change trend by using the large model. According to the invention, monitoring and early warning of systems, services and data can be realized based on a large model.

Description

Technical Field

[0001] One or more embodiments of the present invention relate to network communication technology, and in particular, to a server monitoring method and a security monitoring and early warning platform based on a large model. Background Art

[0002] With the continuous development of network applications, the security operation center has more and more services, and the demand for servers has also increased. The workload of monitoring and managing these servers has increased dramatically, requiring more human resources to ensure the normal operation of the servers and to promptly detect and respond to potential security threats. Server security threats often require real-time responses, and the increase in the number of servers may cause security personnel to be unable to promptly detect and respond to potential problems, thereby increasing the risk of system attacks. The increase in the number of servers has brought about management complexity, and a more efficient system is needed to assist administrators in monitoring, managing, and responding to security incidents on each server. Traditional monitoring and early warning methods mainly rely on manual inspections and simple threshold judgments. When dealing with large-scale, complex data and systems, this method often has problems such as slow response speed, low accuracy, and high false alarm rate. Summary of the invention

[0003] One or more embodiments of the present invention describe a server monitoring method and a security monitoring and early warning platform based on a large model, which can solve at least one problem in the prior art.

[0004] According to a first aspect, a server monitoring method based on a large model is provided, and the method is applied to a security monitoring and early warning platform; a client is installed in each server to be monitored; the method further comprises:

[0005] The security monitoring and early warning platform uses the client in the server to collect the performance indicators of the server, and monitors the operating status and operating data of the server based on the collected performance indicators of the server;

[0006] The security monitoring and early warning platform uses the client in the server to monitor the status of the application services and business program services running on the server;

[0007] The security monitoring and early warning platform pulls business program data through the API interface, inputs the pulled business program data into a pre-trained large model, and uses the large model to discover abnormal behavior and predict data change trends.

[0008] The performance indicator includes at least one of: CPU utilization, memory usage, hard disk space occupancy, and network interface data;

[0009] and / or,

[0010] The monitoring of the operating status and operating data of the server based on the collected performance indicators of the server includes: using a preset performance indicator threshold to verify the actual value of a performance indicator of a server collected in real time, and if the actual value exceeds the threshold, automatically sending an alarm notification to the person in charge of the server.

[0011] The client is installed in each server to be monitored, including:

[0012] The client and its dependent packages are sent to each server that needs to be monitored, and the client service is run to execute the installation script, which automatically completes the configuration and startup of the service. During the installation process, the user is guided to enter the IP address of the security monitoring and early warning platform to which the data needs to be transmitted;

[0013] or,

[0014] Log in to each server that needs to be monitored, and each server executes a predetermined command to download the client and its dependent program packages from the public network. After the download is complete, run the client service to execute the installation script, and the script automatically completes the configuration and startup of the service. During the installation process, the user is guided to enter the IP address of the security monitoring and early warning platform to which the data needs to be transmitted back.

[0015] After the client is installed in each server to be monitored, the method further includes:

[0016] At each scheduled period, each client installed in each server uploads its own client version information to the security early warning monitoring platform;

[0017] The security monitoring and early warning platform performs version verification, comparing the latest version information recorded by the platform with the version information uploaded by the client. If there is a discrepancy, the client's update process is triggered and the latest version of the client's program package is sent to the client;

[0018] If the client update fails, the security monitoring and early warning platform will roll back the program of the wrongly updated client and restore the program of the wrongly updated client to the stable state of the previous version.

[0019] The security monitoring and early warning platform uses the client in the server to monitor the status of the application services and business program services running on the server, including:

[0020] When the security monitoring and early warning platform detects that the application service stops due to a fault, it records the event and automatically starts the built-in restart mechanism; the security monitoring and early warning platform continuously monitors the status of the application services and business program services on the server. If it detects that the service is abnormal or stopped, exceeds the abnormal threshold, and the system cannot automatically restore the program running status, the early warning system will be triggered and a reminder notification will be sent to the relevant person in charge via email and / or work order.

[0021] The method further includes: training the large model by learning normal server behavior patterns; and the large model analyzes and learns various normal historical data pulled by the API interface and generates a data model;

[0022] The use of the large model to discover abnormal behavior and predict data change trends includes:

[0023] The large model substitutes the data pulled by the API interface into the data model, detects whether the data is abnormal, and issues an alarm for abnormal data.

[0024] The method further comprises:

[0025] Add monitoring items corresponding to third-party service monitoring on the system page of the security monitoring and early warning platform to monitor third-party services;

[0026] For the business system data that needs to be monitored, add the API interface that needs to be monitored on the system page of the security monitoring and early warning platform, automatically pull the data and parse it, and display the parsed fields, so as to select and configure the fields that need to be monitored; and update the monitored data in real time on the monitoring page.

[0027] According to a second aspect, a security monitoring and early warning platform is provided, the security monitoring and early warning platform comprising:

[0028] A client deployment module is configured to install the client in each server that needs to be monitored;

[0029] The system performance monitoring module is configured to receive the performance indicators of the server collected by the client in the server, and monitor the operation status and operation data of the server according to the collected performance indicators of the server;

[0030] A service monitoring module configured to monitor the status of application services and business program services running on the server using a client in the server;

[0031] The data monitoring module is configured to pull business program data through an API interface, input the pulled business program data into a pre-trained large model, and use the large model to discover abnormal behaviors and predict data change trends.

[0032] According to a third aspect, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed in a computer, the method described in any embodiment of the present invention is implemented.

[0033] According to a fourth aspect, a computing device is provided, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method described in any embodiment of the present invention is implemented.

[0034] The large-model-based server monitoring method and security monitoring and early warning platform provided by various embodiments of the present invention not only enhance security and stability, but also include improving management efficiency, ensuring data integrity and quality, and quickly responding to threats, providing comprehensive security protection for enterprises and organizations.

[0035] At least the following beneficial effects are achieved:

[0036] 1. Real-time system performance perception: The security monitoring and early warning platform can monitor various system performance indicators in real time, such as CPU usage, memory usage, network bandwidth, etc. Through the collection and analysis of this data, the platform can quickly identify potential performance bottlenecks and potential problems, and provide administrators with targeted optimization suggestions. Real-time performance perception helps administrators intervene before problems occur, ensuring that the system can still run stably under high load and complex environments.

[0037] 2. Rapid response and problem solving: When the platform detects abnormal behavior, security incidents or potential problems, it can immediately trigger an early warning mechanism and notify relevant personnel through emails, work orders, etc. This rapid response mechanism enables relevant personnel to quickly locate the problem and take appropriate measures to solve it, thereby reducing the risk of the system being attacked or damaged. Rapid response and problem solving can significantly improve the availability and reliability of the system and reduce business interruptions and data loss caused by system failures.

[0038] 3. Data integrity and quality assurance: The security monitoring and early warning platform conducts comprehensive monitoring of data, uses large models to train data to generate daily models, and verifies each data to evaluate the integrity and quality of the data. Once data anomalies are found, the platform can issue an early warning in a timely manner and notify management personnel through emails, work orders, etc. to ensure the accuracy and integrity of the data, which helps maintain the reliability of business operations.

[0039] 4. Improve management efficiency: The security monitoring and early warning platform can reduce the workload of administrators and improve management efficiency through centralized management and automation. Automated monitoring and alarming reduce reliance on manual intervention, allowing administrators to focus more on key tasks. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0041] Figure 1 It is a schematic diagram of a system architecture applied in one embodiment of the present invention.

[0042] Figure 2 It is a flow chart of a server monitoring method based on a large model in one embodiment of the present invention.

[0043] Figure 3 It is a flow chart of a client installation method executed by a security monitoring and early warning platform in one embodiment of the present invention.

[0044] Figure 4 It is a flow chart of a client updating method executed by a security monitoring and early warning platform in one embodiment of the present invention.

[0045] Figure 5 It is a client data monitoring flow chart executed by a security monitoring and early warning platform in one embodiment of the present invention.

[0046] Figure 6 It is a flow chart of data monitoring and analysis performed by a security monitoring and early warning platform in one embodiment of the present invention.

[0047] Figure 7 It is a structural diagram of a security monitoring and early warning platform in one embodiment of the present invention. DETAILED DESCRIPTION

[0048] The solution provided by the present invention is described below in conjunction with the accompanying drawings.

[0049] First of all, it should be noted that the terms used in the embodiments of the present invention are only for the purpose of describing specific embodiments, and are not intended to limit the present invention. The singular forms "a", "the" and "the" used in the embodiments of the present invention and the appended claims are also intended to include plural forms, unless the context clearly indicates otherwise.

[0050] It should be understood that the term "and / or" used in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.

[0051] In order to facilitate understanding of the method provided by the present invention, the system architecture involved and applicable to the present invention is first described. Figure 1 As shown in , the system includes: N servers and a security monitoring and early warning platform, where N is a positive integer greater than 1.

[0052] It should be understood that Figure 1 The number of servers and security monitoring and early warning platforms in the example is only for reference. Any number can be selected and deployed according to the implementation requirements.

[0053] Figure 2 FIG. 1 is a flow chart of a server monitoring method based on a large model in one embodiment of the present invention. Figure 1 and Figure 2 , the method comprising:

[0054] Step 201: Install the client in each server to be monitored in advance.

[0055] Step 203: The security monitoring and early warning platform uses the client in the server to collect the performance indicators of the server, and monitors the operating status and operating data of the server according to the collected performance indicators of the server.

[0056] Step 205: The security monitoring and early warning platform uses the client in the server to monitor the status of the application services and business program services running on the server.

[0057] Step 207: The security monitoring and early warning platform pulls business program data through the API interface, inputs the pulled business program data into a pre-trained large model, and uses the large model to discover abnormal behaviors and predict data change trends.

[0058] according to Figure 2 It can be seen from the process shown that in the embodiment of the present invention, the monitoring and early warning of systems, services, and data can be realized based on the large model. Even when dealing with large-scale and complex data and systems, it can achieve beneficial effects such as rapid response, high accuracy, and low false alarm rate. The security monitoring and early warning platform can monitor and manage a large number of servers more efficiently to ensure the safe and stable operation of the information system. This can not only cope with the growing demand for servers, but also effectively reduce labor costs and improve the overall level of security operations.

[0059] according to Figure 2The method of the embodiment of the present invention shown can instantly obtain the performance indicators of the server system's CPU, memory, network, hard disk, and each hard disk partition, so as to monitor the operation of the server system to ensure the stability and overall health of the server. By evaluating the service quality and data integrity, the API interface is used to flexibly pull data, and the data is monitored in combination with a large model to ensure that the data is maintained within a normal range. The system can issue early warning notifications in a timely manner when an abnormality or potential problem is found, thereby improving the reliability and stability of the system.

[0060] The method of the embodiment of the present invention not only focuses on the hardware level, but also comprehensively grasps the operation status of the system by evaluating the service quality and data integrity. The API interface is used to flexibly pull data, and the engine is combined to monitor data, which helps the system to achieve detailed supervision of data and ensure that the data is always maintained within the normal range.

[0061] Furthermore, the method of the embodiment of the present invention introduces an advanced early warning mechanism. Using a large model to process and analyze daily data, for example, a prediction model of the data can be generated and the data can be used for prediction. When anomalies or potential problems are found, the system can trigger early warning notifications in a timely manner, providing administrators with immediate and accurate information so that they can quickly take necessary corrective measures. This rapid response mechanism not only helps to improve the reliability and stability of the system, but also helps to minimize the impact of potential problems on the business.

[0062] Below Figure 2 Each of the steps shown is explained separately.

[0063] First, for step 201: pre-install the client in each server that needs to be monitored.

[0064] By deploying the monitoring client, we can comprehensively collect the key performance indicators of the server, including CPU utilization, memory usage, hard disk space usage, network interface and other related data. After being sorted and analyzed, these data will be sent back to the server so that we can monitor and evaluate the health of the server in real time to ensure its stable operation and efficient performance.

[0065] The installation process of the monitoring client can be deployed offline or online to adapt to different network environments and deployment requirements.

[0066] Method 1: Offline deployment

[0067] In method 1, see Figure 3The process of step 201 includes: remotely sending the client and its dependent program packages to each server that needs to be monitored, running the client service, thereby executing the installation script, and the script automatically completes the configuration and startup of the service; wherein, during the installation process, the user is guided to enter the IP address of the security monitoring and early warning platform to which the data needs to be transmitted back.

[0068] Method 2: Online deployment.

[0069] In method 2, the process of step 201 includes: logging in to each server that needs to be monitored, and each server executes a predetermined command to download the client and its dependent program packages from the public network. After the download is complete, the client service is run to execute the installation script, and the script automatically completes the configuration and startup of the service; wherein, during the installation process, the user is guided to enter the IP address of the security monitoring and early warning platform to which the data needs to be transmitted back.

[0070] After the client is successfully installed in step 201, the server, i.e., the security monitoring and early warning platform, begins to receive and display relevant information from the current server, including but not limited to performance indicators, service status, etc. In this way, the administrator can centrally manage and monitor the server cluster through the server monitoring interface.

[0071] It should be noted that, because the client program may be updated according to business needs, an embodiment of the present invention also includes updating processing of the client and rolling back processing when the update fails. Thus, after step 201, the method further includes:

[0072] Step 221: At each predetermined period, each client installed in each server uploads its own client version information to the security early warning monitoring platform;

[0073] Step 223: The security monitoring and early warning platform performs version verification, comparing the latest version information recorded by the platform with the version information uploaded by the client. If they are inconsistent, the client update process is triggered, and the latest version of the client program package is sent to the client; and

[0074] Step 225: If the client update fails, the security monitoring and early warning platform rolls back the program of the client that has updated the error, and restores the program of the client that has updated the error to the stable state of the previous version.

[0075] In one embodiment of the present invention, see Figure 4, the automatic version update process of the client includes: when the client program update package is successfully uploaded to the security warning monitoring platform, the platform will immediately start the version verification mechanism. The system will accurately compare the version number information recorded by the platform with the version number information sent by the client. Once a difference in the version number is found, the platform will automatically trigger the update process and seamlessly send the latest program package to the client, ensuring that the client program can be automatically updated smoothly and efficiently without any additional operations. We are committed to providing users with a safe and convenient update experience, ensuring that the client program always keeps the latest version to meet changing needs.

[0076] In one embodiment of the present invention, see Figure 4 , when the client version is updated incorrectly, a rollback operation will be performed. The process includes: When the client program encounters a failure during the update process, the security warning monitoring platform will quickly activate the emergency mechanism to ensure system stability and user data security. First, the platform will automatically roll back the program with the update error and restore the client program to the stable state of the previous version to avoid potential risks caused by update problems. During the rollback process, the platform will record the specific information of the update failure in detail, including key data such as error code, occurrence time, and involved clients. These update failure logs will be systematically sorted and transmitted back to the monitoring and warning platform for management personnel to conduct in-depth analysis and processing.

[0077] After the client is installed and updated in the server using the above process, the client can be used for real-time monitoring.

[0078] Next, in step 203 , the security monitoring and early warning platform uses the client in the server to collect the performance indicators of the server, and monitors the operating status and operating data of the server according to the collected performance indicators of the server.

[0079] See also Figure 5 In this step 203, the performance indicators include at least one of: CPU utilization, memory usage, hard disk space occupancy, and network interface data.

[0080] See also Figure 5 In this step 203, the security monitoring and early warning platform monitors the operating status and operating data of the server according to the collected performance indicators of the server, including: the security monitoring and early warning platform uses the preset performance indicator threshold to verify the actual value of the performance indicator of a server collected in real time, and if the actual value exceeds the threshold, it automatically sends an alarm notification to the person in charge of the server.

[0081] By monitoring key performance indicators, we can fully understand the overall health of the server. And through flexible configuration of thresholds, we can monitor the status of the server in a personalized way according to actual needs, making the system more adaptable to diverse operating environments.

[0082] In the embodiment of the present invention, not only can an alarm be sent to the server manager, but also an intelligent analysis function can be provided to the manager to provide detailed fault diagnosis and suggested solutions. This intelligent alarm system helps to improve the problem response speed and reduce the potential impact of faults on the business.

[0083] Next, in step 205 , the security monitoring and early warning platform uses the client in the server to monitor the status of the application services and business program services running on the server.

[0084] See also Figure 5 In this step 205, the process in which the security monitoring and early warning platform uses the client in the server to monitor the status of the application services and business program services running on the server includes: when the security monitoring and early warning platform detects that the application service stops due to a fault, it records the event and automatically starts the built-in restart mechanism; the security monitoring and early warning platform continuously monitors the status of the application services and business program services on the server. If it is detected that the service is abnormal or stopped, exceeding the abnormal threshold, and the system cannot automatically restore the program running status, the early warning system is triggered, and a reminder notification is sent to the relevant person in charge via email and / or work order.

[0085] For the process of step 205, specifically:

[0086] 1. Real-time monitoring and data feedback: The client monitors the operating status of application services and business program services around the clock, and captures and receives key operating data in real time. These data are then efficiently and securely transmitted to our security monitoring and early warning platform, providing a solid foundation for subsequent monitoring and decision-making.

[0087] 2. Automatic fault recovery mechanism: When the platform detects that the application service stops due to a fault, the system will immediately record the event and automatically start the built-in restart mechanism. This process does not require manual intervention by the user. The user only needs to view the service status in real time on the platform interface and directly perform the restart operation when necessary. This automated fault recovery process greatly shortens the service interruption time and effectively ensures the continuity and stability of the business.

[0088] 3. Real-time warning and rapid response: The security monitoring and warning platform ensures the stable operation of the service by continuously monitoring the application services and business program status on the server. Once a service abnormality or stop is detected, exceeding the abnormal threshold, and the system cannot automatically restore the program running status, the platform will trigger the warning system and send detailed reminder notifications to the relevant person in charge through emails, work orders, etc. This instant warning mechanism enables the person in charge to grasp the service status at the first time and take countermeasures quickly, thereby minimizing the risks caused by service interruptions and improving the overall availability and stability of the system.

[0089] Next, for step 207: the security monitoring and early warning platform pulls business program data through the API interface, inputs the pulled business program data into a pre-trained large model, and uses the large model to discover abnormal behaviors and predict data change trends.

[0090] In the embodiment of the present invention, the big model is trained in advance by learning normal server behavior patterns; after the training is completed, the big model analyzes and learns various normal historical data pulled by the API interface and generates a data model. Thus, in this step 207, the process of using the big model to discover abnormal behavior and predict data change trends may include:

[0091] The large model substitutes the data pulled by the API interface into the data model, detects whether the data is abnormal, and issues an alarm for abnormal data.

[0092] In an embodiment of the present invention, the big model technology can improve the ability to identify abnormal behaviors by analyzing and learning a large amount of historical data, thereby realizing intelligent monitoring and early warning of systems, services and data to meet the needs of information and intelligent development, while ensuring the security of systems, services and data.

[0093] See also Figure 6 For step 207, the business system program related data may be monitored, specifically:

[0094] 1. The security monitoring and early warning platform uses advanced program API interfaces to pull program data in real time to ensure continuous and uninterrupted data monitoring. The integrated large-model machine learning algorithm can efficiently process massive amounts of data, conduct fast and accurate analysis, and maintain high sensitivity and precise monitoring of real-time data. These large models can accurately predict trends and potential changes in data, helping us to gain insight into potential problems in advance and foresee possible abnormal conditions in the system. As a result, we can take preventive strategies in a timely manner and effectively avoid security risks.

[0095] 2. Large-model machine learning is not only good at processing regular data, but also can keenly identify abnormal patterns in the data and data points that do not conform to normal behavior. Once any abnormal situation is found, the platform will immediately trigger the automated notification mechanism to quickly notify the relevant responsible persons through email or work orders to ensure that they can respond quickly and solve the problem in a timely manner.

[0096] 3. With the help of large-scale machine learning, our monitoring system has achieved intelligent upgrades. It can automatically identify problems and perform predictive maintenance, significantly improving the work efficiency of the person in charge and reducing the response time to problems. This intelligent monitoring method not only optimizes the overall performance of the system, but also improves user experience and satisfaction.

[0097] 4. The large-model machine learning algorithm has strong learning and adaptability. It can continuously learn and adapt to new data models and continuously improve its prediction and monitoring capabilities. This makes our monitoring system highly flexible and adaptable, and can better cope with the ever-changing data environment and system requirements, ensuring that the system always maintains the best operating state.

[0098] In one embodiment of the present invention, the server monitoring method based on the large model may further include:

[0099] Step 209: Add monitoring items corresponding to third-party service monitoring on the system page of the security monitoring and early warning platform to implement monitoring of third-party services;

[0100] Step 211: For the business system data that needs to be monitored, add the API interface that needs to be monitored on the system page of the security monitoring and early warning platform, automatically pull the data and parse it, display the parsed fields, so as to select and configure the fields that need to be monitored; and update the monitored data in real time on the monitoring page.

[0101] Through the above-mentioned process of step 209 and step 211, third-party services and business system data can be adapted. Specifically, it includes:

[0102] 1. Third-party service monitoring: Simplify the configuration process of third-party service monitoring, and easily add the required monitoring items on the system page. Whether it is system services, business programs or Docker internal services, they can be accurately included in the monitoring scope. This optimization ensures comprehensive coverage and real-time monitoring of system services, allowing you to grasp the service operation status at any time.

[0103] 2. Business system data monitoring: For business system data monitoring, we have introduced intelligent configuration options. Simply add the API interface to be monitored on the system page, and the system will automatically pull the data and parse it. The parsed fields will be displayed in a clear and intuitive way, and you can quickly select and configure the fields you want to monitor. The monitored data will be updated in real time on the relevant data monitoring page, helping you to discover and solve problems in a timely manner and ensure the stable operation of the business system.

[0104] An embodiment of the present invention also provides a security monitoring and early warning platform, see Figure 7 , the security monitoring and early warning platform includes:

[0105] The client deployment module 701 is configured to install the client in each server that needs to be monitored;

[0106] The system performance monitoring module 702 is configured to receive the performance indicators of the server collected by the client in the server, and monitor the operation status and operation data of the server according to the collected performance indicators of the server;

[0107] The service monitoring module 703 is configured to monitor the status of the application services and business program services running on the server using the client in the server;

[0108] The data monitoring module 704 is configured to pull business program data through an API interface, input the pulled business program data into a pre-trained large model, and use the large model to discover abnormal behaviors and predict data change trends.

[0109] In one embodiment of the present invention, when the system performance monitoring module 702 monitors the operating status and operating data of the server based on the collected performance indicators of the server, it is specifically configured to execute: using a preset performance indicator threshold to verify the actual value of a performance indicator of a server collected in real time, if the actual value exceeds the threshold, automatically sending an alarm notification to the person in charge of the server.

[0110] In one embodiment of the present invention, the client deployment module 701 is specifically configured to execute: sending the client and its dependent program packages to each server that needs to be monitored, running the client service, thereby executing the installation script, and the script automatically completes the configuration and startup of the service; wherein, during the installation process, the installation program guides the user to enter the IP address of the security monitoring and early warning platform to which the data needs to be transmitted back.

[0111] In one embodiment of the present invention, at each predetermined period, each client installed in each server uploads its own client version information to the security early warning monitoring platform;

[0112] The client deployment module 701 in the security monitoring and early warning platform is further configured to execute:

[0113] Perform version verification, compare the latest version information recorded by the platform with the version information uploaded by the client, and if they are inconsistent, trigger the client update process and send the latest version of the client program package to the client; and

[0114] If the client update fails, the program of the wrongly updated client is rolled back to restore the program of the wrongly updated client to the stable state of the previous version.

[0115] In one embodiment of the present invention, the service monitoring module 703 is specifically configured to execute:

[0116] When the security monitoring and early warning platform detects that the application service stops due to a fault, it records the event and automatically starts the built-in restart mechanism; the security monitoring and early warning platform continuously monitors the status of the application services and business program services on the server. If it detects that the service is abnormal or stopped, exceeds the abnormal threshold, and the system cannot automatically restore the program running status, the early warning system will be triggered and a reminder notification will be sent to the relevant person in charge via email and / or work order.

[0117] It should be noted that the above-mentioned devices are usually implemented on the server side, and can be set on independent servers respectively, or some or all of the devices can be combined and set on the same server. The server can be a single server or a server cluster composed of multiple servers. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system. The above-mentioned devices can also be implemented on a computer terminal with strong computing power.

[0118] An embodiment of the present invention provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed in a computer, the computer is caused to execute a method in any one of the embodiments in the specification.

[0119] An embodiment of the present invention provides a computing device, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method in any embodiment of the specification is implemented.

[0120] It is to be understood that the structure illustrated in the embodiment of the present invention does not constitute a specific limitation on the device of the embodiment of the present invention. In other embodiments of the specification, the above-mentioned device may include more or fewer components than those shown in the figure, or combine some components, or split some components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0121] The various embodiments of the present invention are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0122] Those skilled in the art should be aware that in one or more of the above examples, the functions described in the present invention can be implemented by hardware, software, widgets, or any combination thereof. When implemented by software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium.

[0123] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solution of the present invention should be included in the scope of protection of the present invention.

Claims

1. A server monitoring method based on a large model, characterized in that: This method is applied to the security monitoring and early warning platform; Install the client on each server that needs to be monitored; The method further includes: The security monitoring and early warning platform uses the client in the server to collect the performance indicators of the server, and monitors the operating status and operating data of the server based on the collected performance indicators of the server; The security monitoring and early warning platform uses the client in the server to monitor the status of the application services and business program services running on the server; The security monitoring and early warning platform pulls business program data through the API interface, inputs the pulled business program data into a pre-trained large model, and uses the large model to discover abnormal behavior and predict data change trends.

2. The method according to claim 1, characterized in that: The performance indicator includes at least one of: CPU utilization, memory usage, hard disk space occupancy, and network interface data; and / or, The monitoring of the operating status and operating data of the server based on the collected performance indicators of the server includes: using a preset performance indicator threshold to verify the actual value of a performance indicator of a server collected in real time, and if the actual value exceeds the threshold, automatically sending an alarm notification to the person in charge of the server.

3. The method according to claim 1, characterized in that The client is installed in each server to be monitored, including: The client and its dependent packages are sent to each server that needs to be monitored, and the client service is run to execute the installation script, which automatically completes the configuration and startup of the service. During the installation process, the user is guided to enter the IP address of the security monitoring and early warning platform to which the data needs to be transmitted; or, Log in to each server that needs to be monitored, and each server executes a predetermined command to download the client and its dependent program packages from the public network. After the download is complete, run the client service to execute the installation script, and the script automatically completes the configuration and startup of the service. During the installation process, the user is guided to enter the IP address of the security monitoring and early warning platform to which the data needs to be transmitted back.

4. The method according to claim 1, characterized in that: After the client is installed in each server to be monitored, the method further includes: At each scheduled period, each client installed in each server uploads its own client version information to the security early warning monitoring platform; The security monitoring and early warning platform performs version verification, comparing the latest version information recorded by the platform with the version information uploaded by the client. If there is a discrepancy, the client's update process is triggered and the latest version of the client's program package is sent to the client; If the client update fails, the security monitoring and early warning platform will roll back the program of the wrongly updated client and restore the program of the wrongly updated client to the stable state of the previous version.

5. The method according to claim 1, characterized in that The security monitoring and early warning platform uses the client in the server to monitor the status of the application services and business program services running on the server, including: When the security monitoring and early warning platform detects that the application service stops due to a fault, it records the event and automatically starts the built-in restart mechanism; the security monitoring and early warning platform continuously monitors the status of the application services and business program services on the server. If it detects that the service is abnormal or stopped, exceeds the abnormal threshold, and the system cannot automatically restore the program running status, the early warning system will be triggered and a reminder notification will be sent to the relevant person in charge via email and / or work order.

6. The method according to any one of claims 1 to 5, characterized in that: The method further includes: training the large model by learning normal server behavior patterns; and the large model analyzes and learns various normal historical data pulled by the API interface and generates a data model; The use of the large model to discover abnormal behavior and predict data change trends includes: The large model substitutes the data pulled by the API interface into the data model, detects whether the data is abnormal, and issues an alarm for abnormal data.

7. The method according to claim 1, characterized in that The method further comprises: Add monitoring items corresponding to third-party service monitoring on the system page of the security monitoring and early warning platform to monitor third-party services; For the business system data that needs to be monitored, add the API interface that needs to be monitored on the system page of the security monitoring and early warning platform, automatically pull the data and parse it, and display the parsed fields, so as to select and configure the fields that need to be monitored; and update the monitored data in real time on the monitoring page.

8. Security monitoring and early warning platform, characterized by: The security monitoring and early warning platform includes: A client deployment module is configured to install the client in each server that needs to be monitored; The system performance monitoring module is configured to receive the performance indicators of the server collected by the client in the server, and monitor the operation status and operation data of the server according to the collected performance indicators of the server; A service monitoring module configured to monitor the status of application services and business program services running on the server using a client in the server; The data monitoring module is configured to pull business program data through an API interface, input the pulled business program data into a pre-trained large model, and use the large model to discover abnormal behaviors and predict data change trends.

9. A computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed in a computer, the method according to any one of claims 1 to 7 is implemented.

10. A computing device, comprising a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method according to any one of claims 1 to 7 is implemented.

Images