Safety early warning method, device, equipment, medium and program product

Abstract

The invention provides a safety early warning method and device, equipment, a medium and a program product, which can be applied to the technical field of artificial intelligence and the technical field of finance. The security early warning method comprises the following steps: performing information extraction on equipment state data, communication state data and service data to obtain a knowledge graph representing a communication relationship between a target device and a plurality of other devices; performing time sequence analysis on the equipment state data and the communication state data to obtain time-varying sequence data of the performance of the target equipment; performing format conversion on the business data to obtain text data representing a business processing process; performing feature extraction on the knowledge graph, the sequence data and the text data according to a feature extraction method matched with the data type to obtain a feature set; performing feature fusion on the feature set to obtain a target feature; and performing safety early warning analysis on the target features to obtain an early warning analysis result.

Description

Technical Field

[0001] The present disclosure relates to the fields of artificial intelligence technology and financial technology, and specifically to a security early warning method, device, equipment, medium and program product. Background Art

[0002] With the rapid development of information technology, the business of financial institutions continues to expand, and the information technology (IT) systems of financial institutions have become increasingly complex. Since IT systems need to ensure high performance, high availability and security in the process of processing a large number of financial transactions, it is crucial to detect and warn IT systems in order to promptly discover and respond to events that may affect service quality and information security. In related technologies, static alarm rules are configured for multiple key dimensions, and real-time indicators are compared with the thresholds set in the static alarm rules. When the collected data exceeds the threshold, an alarm is sent to the staff so that the staff can maintain the current status of the IT system based on the alarm results.

[0003] In the process of realizing the concept of the present disclosure, there are at least the following problems in the related technology: when faced with a complex and dynamically changing business environment, the early warning method used in the related technology cannot change the alarm rules in time to adapt to the changes in the business environment, which easily causes false alarms and missed alarms. Summary of the invention

[0004] In view of the above problems, the present disclosure provides a security warning method, device, equipment, medium and program product for improving the accuracy of security group warning.

[0005] According to the first aspect of the present disclosure, a security warning method is provided, characterized in that the method includes: extracting information from device status data, communication status data and business data to obtain a knowledge graph that characterizes the communication relationship between a target device and multiple other devices; performing time series analysis on the device status data and the communication status data to obtain sequence data of performance changes of the target device over time; performing format conversion on the business data to obtain text data that characterizes the business processing process; performing feature extraction on the knowledge graph, the sequence data and the text data respectively according to a feature extraction method that matches the data type to obtain a feature set; performing feature fusion on the feature set to obtain target features; performing security warning analysis on the target features to obtain warning analysis results.

[0006] According to an embodiment of the present disclosure, the above-mentioned information extraction of device status data, communication status data and business data is performed to obtain a knowledge graph characterizing the communication relationship between the target device and multiple other devices, including: obtaining a node in the knowledge graph based on the device identification in the above-mentioned device status data; and obtaining an association relationship between multiple devices based on the above-mentioned communication status data and the device links for processing business in the above-mentioned business data, as edges in the above-mentioned knowledge graph, thereby obtaining the above-mentioned knowledge graph.

[0007] According to an embodiment of the present disclosure, the above-mentioned device status data and the above-mentioned communication status data are subjected to time series analysis to obtain sequence data of performance changes of the above-mentioned target device over time, including: arranging the above-mentioned device status data and the above-mentioned communication status data in time series respectively to obtain sequence data about the device and sequence data about the communication.

[0008] According to an embodiment of the present disclosure, the method further includes: when it is determined that there is missing data in the sequence data, using an autoregressive sum moving average model to complete the subsequence data of the sequence data in a time period adjacent to the missing data.

[0009] According to an embodiment of the present disclosure, the above-mentioned knowledge graph, the above-mentioned sequence data and the above-mentioned text data are respectively subjected to feature extraction according to the feature extraction method matching the data type to obtain a feature set, including: using a visual encoder to extract features from the above-mentioned sequence data; using a codec to extract features from the above-mentioned text data; and using a graph neural network to extract features from the above-mentioned knowledge graph.

[0010] According to an embodiment of the present disclosure, the above-mentioned feature fusion is performed on the above-mentioned feature set to obtain the target feature, including: splicing multiple features in the above-mentioned feature set to obtain the above-mentioned target feature.

[0011] According to an embodiment of the present disclosure, the above-mentioned security warning analysis is performed on the above-mentioned target characteristics to obtain warning analysis results, including at least one of the following: performing user behavior security warning analysis on the above-mentioned target characteristics to obtain user warning analysis results; performing device security warning analysis on the above-mentioned target characteristics to obtain device warning analysis results; and performing network security warning analysis on the above-mentioned target characteristics to obtain network warning analysis results.

[0012] The second aspect of the present disclosure provides a security warning device, characterized in that the above-mentioned device includes: an information extraction module, which is used to extract information from device status data, communication status data and business data to obtain a knowledge graph characterizing the communication relationship between multiple devices, wherein the multiple above-mentioned devices include at least one target device; a timing analysis module, which is used to perform timing analysis on the above-mentioned device status data and the above-mentioned communication status data to obtain sequence data characterizing the performance changes of at least one of the above-mentioned target devices over time; a format conversion module, which is used to perform format conversion on the above-mentioned business data to obtain text data characterizing the business processing process; a feature extraction module, which is used to perform feature extraction on the above-mentioned knowledge graph, the above-mentioned sequence data and the above-mentioned text data respectively according to a feature extraction method matching the data type to obtain a feature set; a feature fusion module, which is used to perform feature fusion on the above-mentioned feature set to obtain a target feature; and a warning analysis module, which is used to perform security warning analysis on the above-mentioned target feature to obtain a warning analysis result.

[0013] A third aspect of the present disclosure provides an electronic device, comprising: one or more processors; and a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the above method.

[0014] The fourth aspect of the present disclosure further provides a computer-readable storage medium having a computer program or instructions stored thereon, which implements the steps of the above method when the above computer program or instructions are executed by a processor.

[0015] The fifth aspect of the present disclosure further provides a computer program product, including a computer program or instructions, which implement the steps of the above method when the above computer program or instructions are executed by a processor.

[0016] According to the embodiments of the present disclosure, information extraction is performed on device status data, communication status data and business data to obtain a knowledge graph representing the communication relationship between multiple devices, time series analysis is performed on device status data and communication status data to obtain sequence data representing the performance change over time of at least one target device, format conversion is performed on business data to obtain text data representing the business processing process, and device status data, communication status data and business data are converted into three types of data: knowledge graph, sequence data and text data, so as to facilitate multi-dimensional representation and multi-dimensional analysis of device status data, communication status data and business data to improve the richness of information and the accuracy of early warning results. The obtained sequence data, text data and knowledge graph are extracted according to the feature extraction method matching the data type, and the features of the data in multiple dimensions are captured from the data of these three data types to obtain a feature set. The feature set is subjected to feature fusion to obtain the target feature representing the current environmental state, and the multiple dimensional features included in the target feature are used to perform security early warning analysis to obtain the early warning analysis result of the target device, thereby improving the accuracy of the early warning and reducing the false alarm rate and the missed alarm rate. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0018] Figure 1 The application scenario diagram of the security warning method, device, equipment, medium and program product according to the embodiment of the present disclosure is schematically shown;

[0019] Figure 2 A flowchart of a safety warning method according to an embodiment of the present disclosure is schematically shown;

[0020] Figure 3 A flowchart for determining a knowledge graph according to an embodiment of the present disclosure is schematically shown;

[0021] Figure 4 A flowchart for determining target features according to an embodiment of the present disclosure is schematically shown;

[0022] Figure 5 The structure diagram of the safety warning device according to the embodiment of the present disclosure is schematically shown;

[0023] Figure 6 A block diagram of an electronic device suitable for implementing a safety warning method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0024] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0025] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0026] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0027] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0028] It should be noted that in the embodiments of the present application, certain software, components, models and other existing solutions in the industry may be mentioned, and they should be regarded as exemplary. Their purpose is only to illustrate the feasibility of implementing the technical solution of the present application, but it does not mean that the present disclosure has or will necessarily use the solution.

[0029] In the technical solution of the present disclosure, the user information (including but not limited to user personal information, user image information, user device information, such as location information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved are all information and data authorized by the user or fully authorized by all parties, and the collection, storage, use, processing, transmission, provision, disclosure and application of the relevant data comply with relevant laws, regulations and standards, take necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0030] In the scenario of using personal information for automated decision-making, the methods, devices, and systems provided by the embodiments of the present disclosure provide users with corresponding operation portals for users to choose to agree or reject the automated decision-making results; if the user chooses to reject, the expert decision-making process will be entered. The expression "automated decision-making" here refers to the activity of automatically analyzing and evaluating a person's behavioral habits, interests and hobbies, or economic, health, credit status, etc. through computer programs, and making decisions. The expression "expert decision-making" here refers to the activity of making decisions by people who specialize in a certain field, have specialized experience, knowledge and skills, and have reached a certain level of professionalism.

[0031] In related technologies, the alarm rules used are static threshold alarms. Engineers or operation and maintenance personnel will set a fixed threshold for each indicator to define the "normal water level" of the indicator. When the actual value of the indicator exceeds the threshold, the corresponding engineer will receive an alarm. Or the data corresponding to the collected indicators are stored in a database or cloud storage space; abnormal events are generated according to the configured threshold static rules, the configured alarm strategy is matched based on the event level, an alarm notification is generated based on the alarm strategy, and the alarm notification object is sent according to the configured alarm notification rules.

[0032] The early warning methods in related technologies cannot cope with normal data fluctuations during business peak periods in a complex environment with dynamically changing data, and cannot provide reasonable suggestions based on the historical and future trends of data. Due to the setting of static thresholds, traditional security early warning methods cannot adapt to new and unknown system environments, and are prone to a large number of false positives and missed positives.

[0033] In order to solve this problem, the embodiments of the present invention provide a security warning method, which extracts information from device status data, communication status data and business data to obtain a knowledge graph that characterizes the communication relationship between a target device and multiple other devices; performs time series analysis on the device status data and communication status data to obtain sequence data that characterizes the performance changes of at least one target device over time; performs format conversion on business data to obtain text data that characterizes the business processing process; performs feature extraction on the knowledge graph, sequence data and text data respectively according to a feature extraction method that matches the data type to obtain a feature set; performs feature fusion on the feature set to obtain target features; and performs security warning analysis on the target features to obtain warning analysis results.

[0034] Figure 1 The application scenario diagram of the security warning method, apparatus, device, medium and program product according to the embodiments of the present disclosure is schematically shown.

[0035] like Figure 1As shown, the application scenario 100 according to this embodiment may include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 is used to provide a medium for a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 may include various connection types, such as wired, wireless communication links, or optical fiber cables, etc.

[0036] The user can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only for example).

[0037] The first terminal device 101, the second terminal device 102, and the third terminal device 103 may be various electronic devices having display screens and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0038] The server 105 may be a server that provides various services, such as a background management server (only as an example) that provides support for websites browsed by users using the first terminal device 101, the second terminal device 102, and the third terminal device 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device.

[0039] It should be noted that the security warning method provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the security warning device provided in the embodiment of the present disclosure can generally be set in the server 105. The security warning method provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105. Accordingly, the security warning device provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the first terminal device 101, the second terminal device 102, the third terminal device 103 and / or the server 105.

[0040] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to the implementation requirements.

[0041] The following will be based on Figure 1 The scene described by Figure 2~Figure 4 The security warning method of the disclosed embodiment is described in detail.

[0042] Figure 2 The flowchart of the safety warning method according to the embodiment of the present disclosure is schematically shown.

[0043] like Figure 2 As shown, the full warning method of this embodiment includes operations S210 to S260.

[0044] In operation S210, information is extracted from the device status data, the communication status data, and the business data to obtain a knowledge graph of the communication relationship between the target device and multiple other devices.

[0045] In operation S220, time series analysis is performed on the device status data and the communication status data to obtain sequence data of performance changes of the target device over time.

[0046] In operation S230, the business data is formatted to obtain text data representing the business processing process.

[0047] In operation S240, feature extraction is performed on the knowledge graph, sequence data, and text data respectively according to a feature extraction method that matches the data type to obtain a feature set.

[0048] In operation S250, feature fusion is performed on the feature set to obtain target features.

[0049] In operation S260, a security warning analysis is performed on the target feature to obtain a warning analysis result.

[0050] According to the embodiments of the present disclosure, device status data, communication status data and business data can be collected by the data collection interface and sensor network pre-deployed on the target device. The target device is the device for early warning analysis, and the target device can be the hardware device of the IT system of the financial institution. Other devices are devices that have a communication relationship with the target device during the business processing of the financial institution.

[0051] According to an embodiment of the present disclosure, the device status data may include multiple hardware indicators, including processor occupancy, memory occupancy, disk read and write rate, etc. The communication status data may include the connection status, communication delay, communication bandwidth, etc. of each communication between the target device and other devices. Business data is the business processing record recorded on the target device during the business processing process, and the business data may include transaction data and system logs.

[0052] According to the embodiments of the present disclosure, information extraction is performed on the collected device status data, communication status data, and business data to obtain the communication relationship between multiple devices in the business system, and the communication relationship is represented in the form of a knowledge graph. Time series analysis is performed on the device status data and communication status data to obtain sequence data including processor occupancy, communication bandwidth, and other data in the device status data and communication status data. Since the business data records information stored in the system such as transaction logs, the business data is converted into a format to obtain text data related to the transaction logs stored in the system, so that the features related to the above data can be extracted for security warning analysis in the subsequent data processing process.

[0053] According to an embodiment of the present disclosure, device status data, communication status data and business data can be obtained by pre-setting data collection points or data contacts, for example, data detection and collection tools pre-set on target devices such as terminal servers, to obtain device status data, communication status data between the target device and other devices, and business data stored in the storage medium of the target device.

[0054] According to the embodiments of the present disclosure, sequence data is data represented in the form of time series, for example, data such as memory usage, disk read / write rate, and communication bandwidth between time node A and time node B that can be represented by time series. Text data is data in text format, for example, text content recorded in system logs. Knowledge graphs represent data in the form of graphs.

[0055] According to the embodiments of the present disclosure, feature extractors corresponding to the knowledge graph, sequence data and text data are trained respectively, and feature extraction is performed respectively using feature extraction methods that match the sequence data, text data and knowledge graph to obtain corresponding feature sets.

[0056] According to an embodiment of the present disclosure, multiple features in a feature set are fused to obtain a target feature containing multiple feature dimensions, so that the target feature is used to characterize the environmental state of the target device. The early warning analysis results are used to warn of events that may threaten the security of the device in the future, such as long-term overheating of the processor, slow response of the IT system, etc. Machine learning technology can be used to perform security early warning analysis on the target features to obtain early warning analysis results for the target device, so that operation and maintenance personnel can respond to possible security incidents based on the early warning analysis results. The early warning analysis results may include at least one of multiple information such as predicted data for each indicator and early warning type.

[0057] According to the embodiments of the present disclosure, information extraction is performed on device status data, communication status data and business data to obtain a knowledge graph representing the communication relationship between multiple devices, time series analysis is performed on device status data and communication status data to obtain sequence data representing the performance change over time of at least one target device, format conversion is performed on business data to obtain text data representing the business processing process, and device status data, communication status data and business data are converted into three types of data: knowledge graph, sequence data and text data, so as to facilitate multi-dimensional representation and multi-dimensional analysis of device status data, communication status data and business data to improve the richness of information and the accuracy of early warning results. The obtained sequence data, text data and knowledge graph are extracted according to the feature extraction method matching the data type, and the features of the data in multiple dimensions are captured from the data of these three data types to obtain a feature set. The feature set is subjected to feature fusion to obtain the target feature representing the current environmental state, and the multiple dimensional features included in the target feature are used to perform security early warning analysis to obtain the early warning analysis result of the target device, thereby improving the accuracy of the early warning and reducing the false alarm rate and the missed alarm rate.

[0058] According to an embodiment of the present disclosure, information is extracted from device status data, communication status data, and business data to obtain a knowledge graph that characterizes the communication relationship between multiple devices, including: obtaining nodes in the knowledge graph based on device identifiers in the device status data; and obtaining association relationships between multiple devices as edges in the knowledge graph based on device links for processing business in the communication status data and business data, thereby obtaining a knowledge graph.

[0059] Figure 3 A flowchart for determining a knowledge graph according to an embodiment of the present disclosure is schematically shown.

[0060] like Figure 3 As shown, the device status data 301 includes multiple device identifiers, and the device identifiers in the device status data are used as nodes 302 of the knowledge graph. According to the connection status or communication bandwidth between any two devices or two device interfaces in the communication status data 303, determine whether there is a connection relationship between the nodes corresponding to other devices and the nodes corresponding to the target device; according to the device links for processing business included in the business data 304, determine the communication direction of the nodes with connection relationships in the knowledge graph, thereby obtaining the association relationship between multiple devices to determine the edges 305 of the knowledge graph. Based on the nodes 302 of the knowledge graph and the edges 305 of the knowledge graph, a knowledge graph 306 composed of directed edges is obtained, and the knowledge graph composed of directed edges can be used to extract the data transmission direction between devices.

[0061] According to an embodiment of the present disclosure, in the knowledge graph 306 composed of directed edges, the communication direction between nodes represents the direction of data flow during business processing. Features related to the business processing sequence of the nodes can be extracted from the knowledge graph 306 composed of directed edges to enrich the feature set, thereby enriching the target features to improve the accuracy of security warnings.

[0062] According to the embodiments of the present disclosure, the communication status data is only used to record the communication data between other devices that communicate with the target device, for example, the communication bandwidth between personal computers and self-service terminals used for business processing in the IT system of a financial institution. The business data records the device links of all nodes involved in the transaction being processed by the target device during the transaction business processing.

[0063] According to the embodiments of the present disclosure, even if there is no device link in the business data that can characterize the connection relationship between the two devices, that is, there may be no transaction business processing relationship between the two devices, but there may be other data transmission between the two devices, so there is a certain communication relationship. Therefore, a part of the edges in the knowledge graph can be determined based on the communication status data, and another part of the edges in the knowledge graph can be determined based on the device link used to process the business in the business data, and the edges of the knowledge graph can be supplemented to obtain a knowledge graph composed of undirected edges. The knowledge graph composed of undirected edges can be used to extract features about the connection relationship between the target device and other devices in the business link.

[0064] According to an embodiment of the present disclosure, based on the communication status data and the device link for processing the business in the business data, the association relationship between the target device and multiple other devices is obtained. Based on the device link for processing the business in the business data, the edge attribute information of the knowledge graph composed of the undirected graph can be determined, wherein the edge attribute information is used to characterize the number of business processing times between nodes within a preset time period or the number of communications generated by business processing. It is convenient to extract the features of the edge attribute information in the subsequent feature fusion and security warning to improve the accuracy of the security warning.

[0065] According to the embodiments of the present disclosure, a knowledge graph is constructed through device status data, communication status data and business data. The characteristics of the knowledge graph are used to retain the association relationship between multiple devices, providing a new feature extraction dimension for security warnings, thereby improving the accuracy of security warnings.

[0066] According to an embodiment of the present disclosure, a time series analysis is performed on device status data and communication status data to obtain sequence data characterizing how the performance of at least one target device changes over time. The method also includes: arranging the device status data and communication status data in time series to obtain sequence data about the device and sequence data about the communication.

[0067] According to an embodiment of the present disclosure, in order to save resources, data collection tasks are usually executed periodically. Based on the collection time of the data in the device status data and the communication status data, the device status data and the communication status data are sorted respectively to obtain sequence data about the device and sequence data about the communication, so as to analyze the sequence data about the device and the sequence data about the communication in a time series, wherein the sequence data about the device may be the values ​​of indicators such as processor occupancy and memory occupancy at multiple time nodes in time period a; the sequence data about communication may be the values ​​of indicators such as communication bandwidth and communication delay at multiple time nodes in time period a.

[0068] According to an embodiment of the present disclosure, business data includes data in various forms, for example, structured JavaScript Object Notation (JSON) data, XML data, etc. By converting the format of the structured data to obtain text data with a unified format, it is convenient to analyze the business data, and obtain features related to business processing based on the text content corresponding to the business data, so as to improve the data analysis dimension of security warnings and thereby improve the accuracy of security warnings.

[0069] According to the embodiments of the present disclosure, the data with time relationships in the device status data and the communication status data are arranged in time series to reflect the changes and trends of the device status data and the communication status data over time, increase the analyzable dimensions of the device status data and the communication status data, and thus improve the accuracy of security warnings.

[0070] According to the embodiments of the present disclosure, for the collected device status data, communication status data and business data, sensitive data can be distinguished from non-sensitive data, and sensitive data processing can be retained in the local private cloud to ensure data security and compliance with management requirements, while non-sensitive data processing and analysis tasks can be deployed to the public cloud platform to improve computing efficiency and scalability.

[0071] Specifically, data is classified to distinguish sensitive data from non-sensitive data. Sensitive data may include business data, device status data, communication status data, etc., while non-sensitive data may include public feature fusion algorithms, etc. Sensitive data is retained in the local private cloud, which means that data storage and processing occur in the financial institution's own data center. The private cloud provides a higher level of security control because it allows financial institutions to manage the physical security, network security and data access rights of the data center themselves. Non-sensitive data processing and analysis tasks are deployed to the public cloud platform, and computing resources and services are provided on demand.

[0072] According to the embodiments of the present disclosure, sensitive data stored in a private cloud can be Figure 2 In operation S210, the sensitive data is desensitized. The data stored in the private cloud and the public cloud can be combined and processed to obtain a data set corresponding to the business data, the device status data, and the communication status data. In order to further improve the security of the data, feature extraction can also be performed on the obtained data set through operation S220 to obtain a feature set after feature extraction, thereby reducing the probability of leakage of sensitive data.

[0073] According to the embodiments of the present disclosure, through this hybrid cloud strategy, financial institutions can utilize the flexibility and cost-effectiveness of the public cloud to process non-sensitive data while maintaining the security and compliance of sensitive data, thereby optimizing the configuration of technical resources.

[0074] According to an embodiment of the present disclosure, the security warning method further includes: when it is determined that there is missing data in the sequence data, using an autoregressive integrated moving average (ARIMA) model to complete the subsequence data of the time period adjacent to the missing data in the sequence data.

[0075] According to the embodiments of the present disclosure, for periodically collected data, there are missing data in continuous time. In the case of missing data in the time period defined by the sequence data, the autoregressive sum moving average model can be used to complete the missing data based on the subsequence data of the time period adjacent to the missing data. Completing the missing data can ensure the integrity of the data and provide multi-dimensional feature data for subsequent feature extraction, such as the overall change characteristics or change trends of the sequence data, thereby improving the accuracy of safety warnings.

[0076] According to an embodiment of the present disclosure, feature extraction is performed on the knowledge graph, sequence data and text data respectively according to a feature extraction method that matches the data type to obtain a feature set, including: extracting features from sequence data using a visual encoder; extracting features from text data using a codec; and extracting features from a knowledge graph using a graph neural network.

[0077] According to an embodiment of the present disclosure, the sequence data can be represented as a curve graph, and the visual encoder can be used to extract features of the sequence data in the curve graph to identify the temporal change characteristics of the sequence data. The visual encoder can extract the rate of change of memory occupancy and the number of extreme points, as well as the interval of its change from the sequence data, wherein the visual encoder can be obtained based on network training such as convolutional neural networks or long short-term memory networks, so as to obtain multiple features for early warning analysis in the sequence data, wherein the use of long short-term memory networks can better process longer sequence data.

[0078] According to an embodiment of the present disclosure, the text data includes data of a text type that characterizes a business processing process, and a codec is used to extract features from the text data to obtain features that can be used to characterize the business processing, wherein the codec may be a codec of the Transformer architecture. For example, if the text data includes an error code for recording the failure of a task execution corresponding to the business, the codec may be used to extract features from the text data to obtain features corresponding to the text data that may include the error code.

[0079] According to an embodiment of the present disclosure, by extracting features from a knowledge graph using a graph neural network, the distribution of nodes in the knowledge graph can be determined, wherein the distribution includes the associations between nodes, and the graph neural network can be a graph convolutional network (GCN). In the case where the communication between multiple nodes is more frequent than other nodes in the knowledge graph, it is more likely to cause events that threaten the security of the network or transactions. By extracting features from the knowledge graph using a graph neural network, the communication status of the nodes in the knowledge graph is extracted, and the communication status of the nodes is used as a feature of security warning.

[0080] According to an embodiment of the present disclosure, for a knowledge graph including edge attribute information, a graph neural network can be used to perform feature extraction on the association relationships between the nodes of the knowledge graph and the variable attribute information between the nodes of the knowledge graph, thereby determining the communication density between different devices and other devices, and using the communication density between multiple devices and the target device as a feature of the security warning. For example, if a device communicates intensively with the target device and the corresponding services between each communication fail to be processed, it can be considered that there is a greater security risk in the communication with the device.

[0081] According to the embodiments of the present disclosure, feature extraction is performed on the data in the data set according to a feature extraction method that matches the data type to obtain features of multiple dimensions from the data set, thereby enriching the feature set used for security warnings and improving the accuracy of the model for security warnings.

[0082] According to an embodiment of the present disclosure, the trained visual encoder, encoder-decoder, and graph neural network are used to extract features from the data in the data set to obtain a feature set, so as to obtain features corresponding to the data in the data set that are more representative of the early warning analysis results, thereby reducing the amount of data processed by the model. According to an embodiment of the present disclosure, the graph neural network can be trained using a community discovery algorithm, which is used to identify communication patterns in the knowledge graph, such as abnormal network connection patterns, which helps to reveal potential security threats.

[0083] Figure 4 The flowchart of determining target features according to an embodiment of the present disclosure is schematically shown.

[0084] like Figure 4 As shown, the device status data 401 and the communication status data 402 are processed respectively to obtain the sequence data 403, wherein the sequence data 403 can be stored in a variety of forms. In order to extract data features of more dimensions as much as possible, the sequence data 403 can be sorted in the form of a curve chart to retain the multi-dimensional features of the sequence data 403.

[0085] Data in text form in business data 404 is obtained to determine text data 405. A knowledge graph 406 representing the communication relationship between multiple devices and a target device is determined based on device state data 401, communication state data 402, and business data 404. A graph neural network 407 is used to extract features from knowledge graph 406; a visual encoder 408 is used to extract features from sequence data 403; a codec 409 is used to extract features from text data 405 to obtain a feature set 410, and multiple features of the feature set 410 obtained after feature extraction are fused to determine a target feature 411.

[0086] Multi-dimensional feature extraction is performed using device status data 401, communication status data 402 and business data 404 to obtain feature set 410, and target feature 411 is obtained after feature fusion based on multiple features of feature set 410 to provide a comprehensive security warning for the target device to improve the accuracy of the warning.

[0087] According to an embodiment of the present disclosure, feature fusion is performed on a feature set to obtain a target feature, including: concatenating multiple features in the feature set to obtain the target feature. Different dimensional and modal features can be concatenated in a concat manner, which enriches the target feature while retaining the expressive power of each feature in the feature set as much as possible, thereby improving the accuracy of the safety warning.

[0088] According to an embodiment of the present disclosure, a security warning analysis is performed on the target features to obtain a warning analysis result, including at least one of the following: performing a user behavior security warning analysis on the target features to obtain a user warning analysis result; performing a device security warning analysis on the target features to obtain a device warning analysis result; and performing a network security warning analysis on the target features to obtain a network warning analysis result.

[0089] According to an embodiment of the present disclosure, the target features can be analyzed by a pre-trained machine learning model, and the machine learning model can be a neural network or a random forest. The machine learning model is trained using historical target features obtained from historical data, wherein the historical data is device status data, communication status data, and business data for a historical time period. The user warning analysis results, device warning analysis results, and network warning analysis results are analysis results of possible risks in future time periods, wherein the length of the future time period can be preset. A pre-trained machine learning model can be used to perform user behavior security warning analysis, device security warning analysis, and network security warning analysis on the target features to obtain warning analysis results.

[0090] According to the embodiments of the present disclosure, for user behavior security warning analysis, device security warning analysis, and network security warning analysis, three different machine learning models can be pre-trained to perform security warning analysis respectively. When one or more warning results are obtained among the user warning analysis results, device warning analysis results, or network warning analysis results, the one or more warning results obtained are determined as warning analysis results.

[0091] According to an embodiment of the present disclosure, the user warning analysis result is used to warn the IT system of threats caused by user operations. The user behavior security warning analysis is performed using target features to obtain the user warning analysis result, wherein the user warning analysis result can be the probability that the user's operation poses a threat to the IT system.

[0092] According to an embodiment of the present disclosure, the equipment early warning analysis result is used to warn of possible hardware equipment failure events, wherein the hardware equipment failure event may include, for example, a processor failure caused by a long-term high processor occupancy rate leading to a long-term overheating of the processor. The target feature is used to perform equipment security early warning analysis to obtain the equipment early warning analysis result, wherein the equipment early warning analysis result may be the probability of a target equipment failure caused by hardware, posing a threat to the operation of the IT system.

[0093] According to an embodiment of the present disclosure, the network early warning analysis result is used to warn of possible communication link failures or reduced communication efficiency of communication links. The target features are used to perform network security early warning analysis to obtain a network early warning analysis result, wherein the network early warning analysis result can be the probability of a threat to an IT system due to a communication network failure.

[0094] According to the embodiments of the present disclosure, machine learning or related algorithms are used to learn patterns and behaviors from historical data, automatically adjust detection strategies to identify abnormal behaviors, and conduct security warning analysis on multiple levels of user security, device security, and network security, thereby providing a more comprehensive security warning perspective for system operation, improving the accuracy of security warnings for the IT systems of financial institutions, and reducing false alarm rates in order to reduce interference with legitimate transactions and improve customer satisfaction, while reducing the workload of the security team. Improving the speed of threat detection can shorten the time window for attacks to be discovered, thereby reducing potential losses.

[0095] According to an embodiment of the present disclosure, in the process of training a machine learning model, the machine learning model can be fine-tuned by a cross-validation method. The performance of the machine learning model is verified by a multi-fold cross-validation method, and the machine learning model is fine-tuned based on the early warning accuracy and early warning false alarm rate of the verified machine learning model.

[0096] Specifically, the historical data used for model training is divided into K subsets, each of which should represent the distribution of the entire data set as much as possible, where K is a positive integer. For each iteration, select a subset as the validation set, and combine the remaining K-1 subsets as the training set. Use the training set to train the machine learning model, evaluate the performance of the model on the validation set, and record the accuracy and false alarm rate of the model. Repeat the above training and validation process K times, selecting a different subset as the validation set each time to ensure that each subset has the opportunity to participate in the model evaluation as a validation set. Take the average value of the performance indicators during the K iterations as the final performance evaluation result of the model. Based on the comprehensive evaluation results of cross-validation, select the model with the best performance as the final machine learning model for security warning.

[0097] According to the embodiments of the present disclosure, during the training of the machine learning model, the accuracy and robustness of the machine learning model can also be verified by the A / B testing method. The machine learning model's indicators in terms of false alarm rate and response time are used to determine the machine learning model with better model effect based on the obtained indicators such as false alarm rate and response time.

[0098] Specifically, use the same historical data and the same training method to train two machine learning models, called version A model and version B model. Record the performance of the two models in the actual operating environment, including key performance indicators such as detection rate, false alarm rate, and response time. Use statistical methods to analyze the performance differences between version A model and version B model to ensure that any observed performance improvement is statistically significant. If the version B model shows significant performance improvement over version A, consider putting the version B model into production. If the performance does not show significant improvement or is worse than version A, continue to optimize version B or explore new model solutions.

[0099] According to an embodiment of the present disclosure, a meta-learning algorithm can be introduced into a machine learning model for security warning to enable the model to quickly adapt to new environments, use reinforcement learning to simulate the decision-making process, and optimize the response strategy.

[0100] According to the embodiments of the present disclosure, the accuracy and robustness of the machine learning model are verified by cross-validation and A / B testing methods, reducing prediction errors caused by overfitting or underfitting of the model. This can provide more reliable and effective protection for the IT systems of financial institutions, respond to potential security threats in a timely manner, and facilitate users to fine-tune model parameters and algorithms according to actual conditions, so that the model can better adapt to the characteristics and needs of the IT systems of financial institutions.

[0101] According to an embodiment of the present disclosure, an explanatory artificial intelligence (AI) module is established in the machine learning model, and the explanatory AI module is used to provide a clear explanation for each warning. The detection data and warning information are displayed in combination with visualization tools, so that operators can understand the decision-making process of the model. The visualization tools include but are not limited to display screens and smart devices.

[0102] According to the embodiments of the present disclosure, an online learning mechanism is adopted to continuously update the machine learning model to reflect the latest system status and threat intelligence, regularly evaluate system performance, and automatically adjust detection strategies and model parameters according to the results, and the accuracy and robustness of the system can be continuously improved through feedback loops using user feedback and real results. Specifically, the machine learning model can be continuously updated by adopting an online learning mechanism, and system performance can be regularly evaluated and detection strategies and model parameters can be automatically adjusted according to the results, and the accuracy and robustness of the system can be continuously improved through feedback loops using user feedback and real results.

[0103] According to the embodiments of the present disclosure, the online learning mechanism allows the machine learning model to continuously learn from new data in actual operation, so as to timely reflect the latest status and threat intelligence of the system; regular evaluation and automatic adjustment enable the system to regularly evaluate its own performance, and automatically adjust the detection strategy and model parameters according to the evaluation results to ensure that it is always in the best state; the feedback loop enables the system to continuously improve itself by using user feedback and real results, forming a feedback loop, so that the accuracy and robustness of the security early warning method are continuously improved. In short, through the online learning mechanism and feedback loop, a continuously improved security early warning solution is provided for the IT system of financial institutions, thereby ensuring the accuracy and robustness of the system and improving user satisfaction.

[0104] Based on the above safety warning method, the present disclosure also provides a safety warning device. Figure 5 The device is described in detail.

[0105] Figure 5 The structural block diagram of the safety warning device according to the embodiment of the present disclosure is schematically shown.

[0106] like Figure 5 As shown, the security warning device 500 of this embodiment includes an information extraction module 510, a timing analysis module 520, a format conversion module 530, a feature extraction module 540, a feature fusion module 550 and a warning analysis module 560.

[0107] The information extraction module 510 extracts information from the device state data, the communication state data and the business data to obtain a knowledge graph representing the communication relationship between the target device and multiple other devices. The information extraction module 510 can be used to perform the operation S210 described above, which will not be repeated here.

[0108] The timing analysis module 520 is used to perform timing analysis on the device status data and the communication status data to obtain sequence data of the performance of the target device over time. The information extraction module 520 can be used to perform the operation S220 described above, which will not be described in detail here.

[0109] The format conversion module 530 is used to convert the format of the business data to obtain text data representing the business processing process. The format conversion module 530 can be used to perform the operation S230 described above, which will not be described in detail here.

[0110] The feature extraction module 540 is used to extract features from the knowledge graph, sequence data and text data respectively according to the feature extraction method matching the data type to obtain a feature set. The feature extraction module 520 can be used to perform the operation S240 described above, which will not be repeated here.

[0111] The feature fusion module 550 is used to perform feature fusion on the feature set to obtain the target feature. The feature fusion module 550 can be used to perform the operation S250 described above, which will not be described in detail here.

[0112] The early warning analysis module 560 is used to perform security early warning analysis on the target features to obtain early warning analysis results. The early warning analysis module 560 can be used to perform the operation S260 described above, which will not be described in detail here.

[0113] According to an embodiment of the present disclosure, the data processing module 510 includes: a node determination unit and an edge determination unit.

[0114] The node determination unit is used to obtain the nodes in the knowledge graph based on the device identification in the device status data.

[0115] The edge determination unit is used to obtain the association relationship between multiple devices based on the communication status data and the device links for processing the business in the business data, as the edges in the knowledge graph, thereby obtaining the knowledge graph.

[0116] According to an embodiment of the present disclosure, the timing analysis module 520 includes: a data arrangement unit.

[0117] The data arrangement unit is used to arrange the device status data and the communication status data in time sequence to obtain sequence data about the device and sequence data about the communication.

[0118] According to an embodiment of the present disclosure, the security warning device 500 further includes: a data completion module.

[0119] The data completion module is used to complete the subsequence data of the time period adjacent to the missing data in the sequence data by using the autoregressive sum moving average model when it is determined that there is missing data in the sequence data.

[0120] According to an embodiment of the present disclosure, the feature extraction module 520 includes: a first extraction unit, a second extraction unit, and a third extraction unit.

[0121] The first extraction unit is used to extract features from the sequence data using a visual encoder.

[0122] The second extraction unit is used to extract features from the text data using a codec.

[0123] The third extraction unit is used to extract features from the knowledge graph using a graph neural network.

[0124] According to an embodiment of the present disclosure, the feature fusion module 530 includes: a feature splicing unit.

[0125] The feature concatenation unit is used to concatenate multiple features in a feature set to obtain a target feature.

[0126] According to an embodiment of the present disclosure, the early warning analysis module 540 includes at least one of the following: a first early warning unit, a second early warning unit, and a third early warning unit.

[0127] The first warning unit is used to perform user behavior security warning analysis on the target features to obtain user warning analysis results.

[0128] The second early warning unit is used to perform equipment safety early warning analysis on the target characteristics to obtain equipment early warning analysis results.

[0129] The third warning unit is used to perform network security warning analysis on target characteristics to obtain network warning analysis results.

[0130] According to an embodiment of the present disclosure, any multiple modules of the information extraction module 510, the timing analysis module 520, the format conversion module 530, the feature extraction module 540, the feature fusion module 550 and the early warning analysis module 560 can be combined in one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the information extraction module 510, the timing analysis module 520, the format conversion module 530, the feature extraction module 540, the feature fusion module 550 and the early warning analysis module 560 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation methods of software, hardware and firmware or in an appropriate combination of any of them. Alternatively, at least one of the information extraction module 510, the timing analysis module 520, the format conversion module 530, the feature extraction module 540, the feature fusion module 550 and the early warning analysis module 560 can be at least partially implemented as a computer program module, and when the computer program module is executed, the corresponding function can be executed.

[0131] Figure 6 A block diagram of an electronic device suitable for implementing a safety warning method according to an embodiment of the present disclosure is schematically shown.

[0132] like Figure 6As shown, the electronic device 600 according to an embodiment of the present disclosure includes a processor 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage part 608 to a random access memory (RAM) 603. The processor 601 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a dedicated microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 601 may also include an onboard memory for caching purposes. The processor 601 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0133] In RAM 603, various programs and data required for the operation of electronic device 600 are stored. Processor 601, ROM 602 and RAM 603 are connected to each other via bus 604. Processor 601 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 602 and / or RAM 603. It should be noted that the program can also be stored in one or more memories other than ROM 602 and RAM 603. Processor 601 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in one or more memories.

[0134] According to an embodiment of the present disclosure, the electronic device 600 may further include an input / output (I / O) interface 605, which is also connected to the bus 604. The electronic device 600 may further include one or more of the following components connected to the input / output (I / O) interface 605: an input portion 606 including a keyboard, a mouse, etc.; an output portion 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 608 including a hard disk, etc.; and a communication portion 609 including a network interface card such as a LAN card, a modem, etc. The communication portion 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the input / output (I / O) interface 605 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 610 as needed, so that a computer program read therefrom is installed into the storage portion 608 as needed.

[0135] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0136] According to an embodiment of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, it may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus or a device. For example, according to an embodiment of the present disclosure, the computer-readable storage medium may include the ROM 602 and / or RAM 603 described above and / or one or more memories other than ROM 602 and RAM 603.

[0137] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program contains program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the security warning method provided by the embodiment of the present disclosure.

[0138] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 601. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0139] In one embodiment, the computer program may rely on tangible storage media such as optical storage devices, magnetic storage devices, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of signals on a network medium, and downloaded and installed through the communication part 609, and / or installed from a removable medium 611. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0140] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 609, and / or installed from the removable medium 611. When the computer program is executed by the processor 601, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, apparatus, module, unit, etc. described above can be implemented by a computer program module.

[0141] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0142] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0143] It will be appreciated by those skilled in the art that the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations or combinations are not explicitly described in the present disclosure. In particular, without departing from the spirit and teachings of the present disclosure, the features described in the various embodiments of the present disclosure may be combined and / or combined in a variety of ways. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0144] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A safety early warning method, characterized in that: The method comprises: Extract information from device status data, communication status data, and business data to obtain a knowledge graph that represents the communication relationship between the target device and multiple other devices; Performing time series analysis on the device status data and the communication status data to obtain sequence data of performance changes of the target device over time; Converting the business data into a text format to obtain text data representing the business processing process; According to a feature extraction method matching the data type, feature extraction is performed on the knowledge graph, the sequence data, and the text data respectively to obtain a feature set; Performing feature fusion on the feature set to obtain target features; and Performing a safety warning analysis on the target features to obtain a warning analysis result.

2. The method according to claim 1, characterized in that The device status data, communication status data and business data are extracted to obtain a knowledge graph representing the communication relationship between the target device and multiple other devices, including: Based on the device identifier in the device status data, obtaining a node in the knowledge graph; and Based on the communication status data and the device links for processing the business in the business data, the association relationship between multiple devices is obtained as the edge in the knowledge graph, thereby obtaining the knowledge graph.

3. The method according to claim 1, characterized in that The performing time series analysis on the device status data and the communication status data to obtain sequence data of performance changes of the target device over time includes: The device status data and the communication status data are arranged in time sequence to obtain sequence data on the device and sequence data on the communication.

4. The method according to claim 1 or 3, characterized in that: The method further comprises: When it is determined that there are missing data in the sequence data, the subsequence data in the time period adjacent to the missing data in the sequence data is completed using an autoregressive sum moving average model.

5. The method according to claim 1, characterized in that The feature extraction method matching the data type is used to extract features from the knowledge graph, the sequence data, and the text data to obtain a feature set, including: Using a visual encoder to extract features from the sequence data; Performing feature extraction on the text data using a codec; A graph neural network is used to extract features from the knowledge graph.

6. The method according to claim 1, characterized in that The step of fusing the feature set to obtain the target feature includes: Multiple features in the feature set are concatenated to obtain the target feature.

7. The method according to claim 1, characterized in that The performing of a security early warning analysis on the target feature to obtain an early warning analysis result includes at least one of the following: Performing user behavior security early warning analysis on the target features to obtain a user early warning analysis result; Performing equipment safety early warning analysis on the target features to obtain equipment early warning analysis results; as well as Perform network security early warning analysis on the target characteristics to obtain network early warning analysis results.

8. A safety warning device, characterized in that: The device comprises: An information extraction module, used to extract information from device status data, communication status data and business data to obtain a knowledge graph representing the communication relationship between multiple devices, wherein the multiple devices include at least one target device; A timing analysis module, used to perform timing analysis on the device status data and the communication status data to obtain sequence data representing the performance of at least one of the target devices changing over time; A format conversion module, used to convert the format of the business data to obtain text data representing the business processing process; A feature extraction module, used to extract features from the knowledge graph, the sequence data, and the text data respectively according to a feature extraction method that matches the data type to obtain a feature set; A feature fusion module, used to perform feature fusion on the feature set to obtain a target feature; and The early warning analysis module is used to perform security early warning analysis on the target characteristics to obtain early warning analysis results.

9. An electronic device, comprising: one or more processors; a memory for storing one or more computer programs, It is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program or instruction stored thereon, characterized in that: When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

11. A computer program product comprising a computer program or instructions, characterized in that When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images