Computer equipment and operation method thereof

Abstract

The invention relates to the technical field of information security, in particular to a computer equipment operation method. The method comprises the following steps: acquiring computer equipment information data, and extracting security policy data according to the computer equipment information data so as to obtain security policy data; building a computer information security topological structure model according to the security policy data so as to obtain the computer information security topological structure model; performing computer communication data extraction according to the computer equipment information data so as to obtain computer communication data; performing communication risk analysis according to the computer communication data so as to obtain communication risk data; and performing communication risk division on the computer information security topological structure model according to the communication risk data so as to obtain a computer communication risk topological structure model. The computer communication operation safety is improved based on the information safety technology.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a computer device operation method. Background Art

[0002] With the rapid development of information technology, computer equipment has become an indispensable tool in modern society. Computer equipment is widely used in various complex computing tasks, data processing, communication management, and various business processing processes. However, with the increasing complexity of tasks and computing loads, a series of problems faced by computer equipment during operation have become increasingly prominent. Computer equipment is at risk of data leakage and malicious attacks during communication. Attackers use communication vulnerabilities to carry out malicious behaviors, such as denial of service attacks and malware implantation. Although traditional security protection measures, such as firewalls and encryption protocols, can cope with some risks to a certain extent, they are still difficult to provide comprehensive and effective protection in the face of complex and multi-level attacks. Summary of the invention

[0003] Based on this, it is necessary for the present invention to provide a computer device and an operating method thereof to solve at least one of the above technical problems.

[0004] To achieve the above object, a computer device operation method comprises the following steps:

[0005] Step S1: Obtain computer device information data, and extract security policy data based on the computer device information data, thereby obtaining security policy data; construct a computer information security topology structure model based on the security policy data, thereby obtaining a computer information security topology structure model;

[0006] Step S2: extracting computer communication data according to the computer device information data, thereby obtaining computer communication data; performing communication risk analysis according to the computer communication data, thereby obtaining communication risk data; dividing the computer information security topology structure model according to the communication risk data, thereby obtaining a computer communication risk topology structure model;

[0007] Step S3: obtaining computer equipment operation logs, and performing computer energy consumption analysis based on the computer equipment operation logs, thereby obtaining computer operation energy consumption data; performing communication vulnerability detection on computer communication data based on the computer communication risk topology structure model, thereby obtaining computer communication vulnerability data;

[0008] Step S4: performing correlation analysis based on the computer operation energy consumption data and the computer communication vulnerability data, thereby obtaining computer communication vulnerability energy consumption correlation data; constructing an intrusion detection system based on the computer communication vulnerability energy consumption correlation data, thereby obtaining intrusion detection system data;

[0009] Step S5: Perform communication operation security monitoring on computer equipment information data according to the intrusion detection system to obtain communication operation security data, and upload it to the computer equipment management cloud platform to execute computer communication security operation tasks.

[0010] The present invention can extract security policies for specific devices by analyzing computer device information data. This helps to formulate personalized security protection measures for the characteristics and configuration of the device, establish a computer information security topology model, and clearly display the connection relationship and security status between devices, providing a basic framework for subsequent risk analysis and management. By analyzing the communication data, potential risk points and vulnerable links are identified, thereby providing a basis for discovering potential security threats. The communication risk division of the computer information security topology model can help identify the security status of different components, and carry out targeted reinforcement to improve the overall security protection capability. By analyzing the computer device operation log, energy consumption patterns can be identified, resource allocation can be optimized, energy consumption can be reduced, and equipment operation efficiency can be improved. According to the topology structure, vulnerability detection is performed on the communication data, and potential security risks can be discovered and repaired in time, reducing the risk of being attacked. By associating computer operation energy consumption and communication vulnerability data, it is possible to identify which vulnerabilities lead to high energy consumption or abnormal energy consumption patterns. This discovery can help the security team give priority to repairing these vulnerabilities, thereby improving security and energy efficiency. An intrusion detection system is constructed based on vulnerability energy consumption association data, which can achieve real-time monitoring and early warning of potential attacks, thereby improving network security protection capabilities. By using an intrusion detection system to monitor the communication and operation security of computer equipment, we can promptly identify and respond to potential security threats, ensure the safe operation of equipment, and upload monitoring data to a computer equipment management cloud platform, which helps to centrally manage and analyze equipment status, form a comprehensive security management system, and realize automated security task execution.

[0011] Optionally, step S1 specifically includes:

[0012] Step S11: acquiring computer device information data, and extracting security policy data according to the computer device information data, thereby obtaining security policy data;

[0013] Step S12: classifying the security policy hierarchy according to the security policy data, thereby obtaining the network layer security policy and the application layer security policy;

[0014] Step S13: constructing routing nodes according to the network layer security policy, thereby obtaining routing node data;

[0015] Step S14: constructing a firewall node according to the application layer security policy, thereby obtaining firewall node data;

[0016] Step S15: performing computer node spatial fusion according to the routing node data and the firewall node data, thereby obtaining computer node data;

[0017] Step S16: Performing computer node communication connection on the computer node data according to the security policy data, thereby obtaining computer node communication data;

[0018] Step S17: constructing a computer information security topology structure model according to the computer node data and the computer node communication data, thereby obtaining a computer information security topology structure model.

[0019] By acquiring computer equipment information data, the present invention can extract security policies related to the equipment, ensure that the security protection measures match the equipment characteristics, thereby improving the effectiveness of the security policy, providing basic data support for subsequent security policy formulation and implementation, and helping to identify potential security risks and needs. Hierarchical classification of security policies (network layer and application layer) can make security management more organized and targeted, help determine the security protection focus of different levels, and optimize the allocation and configuration of resources according to the classification results to ensure that the corresponding security policies can be effectively implemented at each level. By constructing routing nodes according to the network layer security policy, a clear network topology can be formed, which helps to identify the flow direction and path of network traffic and improve the effectiveness of network management. The construction of routing nodes can be combined with security policies to enhance the monitoring and control of network traffic and prevent potential network attacks. Building firewall nodes can provide additional protection for application layer security, ensure that the communication between the application and the network is strictly monitored, and through the firewall nodes of the application layer, the security policy can be refined, and the traffic of specific applications can be filtered and controlled to improve overall security. By spatially fusing routing node data with firewall node data to form complete computer node data, the network security status can be more comprehensively reflected. The integrated data helps to simplify the network management process and improve the visualization of computer equipment and network environment. By connecting computer node data, complete computer node communication data can be generated, providing an important basis for subsequent security analysis. Establishing communication connections between nodes helps to monitor network traffic and communication behavior in real time, detect abnormal situations in time and take corresponding protective measures. The information security topology model constructed based on computer node data and communication data can clearly show the relationship and status of each node in the network, helping security managers to quickly identify security risks. The information security topology model provides decision support for the formulation and implementation of security policies, helping managers to better understand the network environment and optimize security protection measures.

[0020] Optionally, step S2 specifically includes:

[0021] Step S21: extracting computer communication data according to computer device information data, thereby obtaining computer communication data;

[0022] Step S22: performing a request service risk analysis based on the computer communication data, thereby obtaining request service risk data;

[0023] Step S23: performing data leakage risk analysis based on computer communication data to obtain data leakage risk data;

[0024] Step S24: integrating communication risk data according to the denial of service attack risk data and the data leakage risk data, thereby obtaining communication risk data;

[0025] Step S25: performing communication risk classification on the computer security topology structure model according to the communication risk data, thereby obtaining a computer communication risk topology structure model.

[0026] By extracting computer communication data, the present invention can obtain detailed information about network activities, including requests, responses, data packet sizes, communication frequencies, etc., providing a basic data source for subsequent analysis. The acquired communication data enables the security team to fully understand the communication behavior of computer devices, helps to identify normal and abnormal communication modes, and lays the foundation for risk analysis. Through risk analysis of request services, loopholes and security risks existing in the service request process can be identified, thereby providing protection for the security of the service. The analysis results can help the development team optimize the service design, enhance the anti-attack capability of the service, and improve the security and reliability of the overall system. Through data leakage risk analysis, potential data leakage points can be identified, so that measures can be taken in advance to prevent the leakage of sensitive data, protect user privacy and corporate secrets, and the analysis results can provide a basis for formulating stricter data access control and protection measures, and improve the effectiveness of data protection. Integrating denial of service attack risk data with data leakage risk data can form a comprehensive communication risk data view, so that security managers can fully understand potential security threats. The integrated communication risk data can help evaluate the priorities of different risks, so that the security team can allocate resources more targetedly for risk mitigation. By dividing the computer security topology model according to the communication risk data, a clear computer communication risk topology model can be formed to help the security team intuitively identify which parts are high-risk. Through communication risk division, managers can implement more stringent security measures for high-risk areas, enhance the overall network security protection capabilities, and effectively reduce the impact of potential attacks.

[0027] Optionally, step S22 is specifically:

[0028] Step S221: extracting communication flow characteristics according to computer communication data, thereby obtaining communication flow data;

[0029] Step S222: decoding the communication traffic data into packets, thereby obtaining packet decoding data;

[0030] Step S223: performing handshake behavior statistics of the data packets according to the decoded data of the data packets, thereby obtaining handshake data packets and non-handshake data packets;

[0031] Step S224: performing data packet transmission frequency statistics according to the data packet decoding data, thereby obtaining high-frequency data packet transmission data and low-frequency data packet transmission data;

[0032] Step S225: performing a false request service intersection operation according to the high-frequency data packet transmission data and the unhandshake data packet data, thereby obtaining false request service data;

[0033] Step S226: performing a real request service intersection operation according to the low-frequency data packet transmission data and the handshake data packet data, thereby obtaining real request service data;

[0034] Step S227: integrating the request service risk according to the false request service data and the real request service data, thereby obtaining the request service risk data.

[0035] The present invention can obtain basic information of network traffic, including traffic type, traffic size and traffic direction, by extracting communication traffic features, providing basic data for subsequent analysis, and the extracted traffic features are helpful to identify the difference between normal communication and abnormal communication, laying the foundation for subsequent risk analysis. By decoding the data packet, the specific content inside the data packet can be analyzed, including information such as source address, destination address, protocol type, etc., providing detailed data support for subsequent behavior analysis, and the decoded data packet content can help detect potential malicious code or suspicious behavior, and enhance network security monitoring capabilities. By counting the handshake and unhandshake data packets, the state of the communication session can be judged, potential abnormal or incomplete connection requests can be identified, and denial of service attacks or other attack behaviors can be found. The statistical information can be used to optimize connection management, ensure that normal connection requests can proceed smoothly, and reduce the resource occupation of incomplete connections. By counting the frequency of data packet transmission, high-frequency and low-frequency data packets can be identified. This information is very important for detecting abnormal traffic patterns (such as attack traffic). The statistical results can be used to adjust network security policies, focus on monitoring the abnormal traffic of high-frequency data packets, and prevent potential attacks. By performing intersection operations on unhandshake packets and high-frequency packets, false request services can be identified, which helps prevent malicious behaviors such as denial of service attacks. The identified false request data can be used to enhance protection capabilities, block suspicious requests in a timely manner, and protect network resources. By performing intersection operations on handshake packets and low-frequency packets, the real request services can be confirmed to ensure that normal communication behaviors are identified and processed. Identifying real request data helps optimize service response mechanisms, ensure that normal requests can be processed in a timely manner, and improve user experience. By integrating false request service data and real request service data, comprehensive request service risk data can be formed to help security teams better understand the risk situation in the network environment. The integrated risk data can help security managers evaluate the priorities of different request services, thereby more effectively allocating resources for risk prevention and processing.

[0036] Optionally, step S23 is specifically:

[0037] Step S231: extracting transmission data features according to computer communication data, thereby obtaining transmission data;

[0038] Step S232: performing transmission protocol identification on the transmission data, thereby obtaining data transmission protocol data;

[0039] Step S233: performing protocol field statistics according to the data transmission protocol data, thereby obtaining abnormal protocol field data;

[0040] Step S234: performing transmission time statistics according to the transmission data, thereby obtaining abnormal transmission time data;

[0041] Step S235: performing data leakage intersection operation according to the abnormal protocol field data and the abnormal transmission time data, thereby obtaining data leakage data;

[0042] Step S236: Perform risk assessment based on the data leakage data to obtain data leakage risk data.

[0043] The present invention can obtain basic information of network transmission, including the size, type and transmission frequency of data packets, etc., by extracting the characteristics of transmission data, providing a data basis for subsequent analysis. The extracted characteristics can help identify the difference between normal transmission and abnormal transmission, and help subsequent risk analysis and monitoring. Protocol identification of transmission data can determine the type of protocol used for data transmission (such as HTTP, FTP, TCP, etc.), providing important information for in-depth analysis. Identifying the protocol type can help locate known vulnerabilities and risks of specific protocols, and provide a basis for subsequent security protection. By counting the protocol fields, abnormal protocol fields that do not meet expectations can be identified. These fields are signs of potential attacks or data leaks. By analyzing the abnormal fields, network security strategies can be adjusted and optimized to ensure that potential security threats can be detected and responded to in a timely manner. By counting the transmission time, abnormal transmission time patterns can be identified to help discover potential data leaks or attack activities. Abnormal transmission time data can be used as a warning signal for security incidents, prompting the security team to conduct further investigation and analysis. By performing intersection operations on abnormal protocol field data and abnormal transmission time data, data leakage incidents can be identified to help discover security risks in advance. Identified data leakage cases can be used to improve and adjust data protection measures to reduce the risk of data leakage. Risk assessment of data leakage data can form a comprehensive risk view to help security teams understand the current security situation. Through risk assessment results, the severity of different data leakage incidents can be evaluated, thereby providing a scientific basis for risk mitigation and resource allocation, ensuring that high-risk incidents are handled first.

[0044] Optionally, step S3 specifically includes:

[0045] Step S31: obtaining a computer device operation log, and performing temperature sensing feature extraction according to the computer device operation log, thereby obtaining temperature sensing data;

[0046] Step S32: obtaining CPU load data and storing the load data;

[0047] Step S33: performing CPU energy consumption analysis on the CPU load data according to the temperature sensing data, thereby obtaining CPU energy consumption temperature data;

[0048] Step S34: performing storage energy consumption analysis on the storage load data according to the temperature sensing data, thereby obtaining storage energy consumption temperature data;

[0049] Step S35: integrating the computer operation energy consumption data according to the CPU energy consumption temperature data and the storage energy consumption temperature data, thereby obtaining the computer operation energy consumption data;

[0050] Step S36: Perform communication vulnerability detection on computer communication data according to the computer communication risk topology structure model, thereby obtaining computer communication vulnerability data.

[0051] By acquiring the operation log of the computer device, the present invention can collect basic information about the device status, operation records and temperature sensor data, and provide data support for subsequent analysis. The operation log can help identify the problems encountered by the device during operation, which is convenient for troubleshooting and performance optimization. Acquiring CPU and storage load data helps to monitor the use of system resources and ensure that the computer device can use resources efficiently during operation. Through the analysis of load data, the performance of the computer device can be evaluated to determine whether there are problems such as overload or resource bottlenecks. According to the temperature sensor data, the energy consumption analysis of the CPU load can identify the energy consumption characteristics of the CPU under different working states, thereby providing a basis for energy consumption optimization. By analyzing the CPU energy consumption, it can help enterprises reduce operating costs, optimize electricity use, and extend the life of hardware. Energy consumption analysis of storage load data can evaluate the energy consumption performance of storage devices at different temperatures, thereby finding room for energy efficiency improvement. Through the analysis of storage energy consumption, the use strategy of storage devices can be optimized to improve the overall efficiency of the storage system. Integrating CPU energy consumption temperature data with storage energy consumption temperature data can form a comprehensive view of computer operation energy consumption data, helping managers to fully understand the energy consumption of equipment. The integrated energy consumption data can provide support for the company's energy management decisions and help formulate reasonable energy consumption control strategies. Vulnerability detection of computer communication data based on the computer communication risk topology model can timely identify potential communication vulnerabilities, prevent data leakage and malicious attacks, and through vulnerability detection, proactively repair identified security risks, enhance the security protection capabilities of computer equipment, and effectively respond to complex network attacks.

[0052] Optionally, step S33 is specifically:

[0053] Step S331: extracting CPU core load distribution features according to the CPU load data, thereby obtaining CPU core load distribution data;

[0054] Step S332: Calculate the core load utilization rate and the operating frequency according to the CPU core load distribution data, thereby obtaining the core load utilization rate data and the CPU operating frequency data;

[0055] Step S333: collecting CPU core load distribution temperature data on the CPU core load distribution data according to the temperature sensing data, thereby obtaining the CPU core load distribution temperature data;

[0056] Step S334: performing usage statistics according to the core load usage data, thereby obtaining CPU high usage data and CPU low usage data;

[0057] Step S335: performing operating frequency statistics on the CPU operating frequency data, thereby obtaining CPU high-frequency operating data and CPU low-frequency operating data;

[0058] Step S336: performing a high energy consumption operation intersection operation on the CPU high usage rate data and the CPU high frequency operation data, thereby obtaining the CPU high energy consumption operation data;

[0059] Step S337: performing a low energy consumption operation intersection operation according to the CPU low usage rate data and the CPU low frequency operation data, thereby obtaining the CPU low energy consumption operation data;

[0060] Step S338: integrating the CPU energy consumption relationship according to the CPU high energy consumption operation data and the CPU low energy consumption operation data, thereby obtaining the CPU energy consumption data;

[0061] Step S339: Perform energy consumption-temperature mapping on the CPU energy consumption data according to the CPU core load distribution temperature data, thereby obtaining the CPU energy consumption-temperature data.

[0062] The present invention can obtain the load of each core by extracting the CPU core load distribution characteristics, and help identify the problem of load imbalance. This data provides a basis for subsequent performance optimization, and managers can adjust the task allocation strategy according to the load distribution. Calculating the core load utilization rate and the CPU operating frequency is helpful to evaluate the work efficiency of each core, identify the cores with high utilization rate and low utilization rate, and by understanding the operating frequency, dynamic adjustment can be performed to ensure that the CPU runs at the optimal frequency when needed to improve energy efficiency. In combination with temperature sensing data, temperature data collection for core load distribution can monitor the temperature changes of different cores during operation, help identify overheating problems, and the correlation analysis of temperature and load helps understand how to reduce energy consumption and improve heat dissipation efficiency, and keep the CPU within a safe operating temperature range. By counting the core load utilization rate, the cores with high utilization rate and low utilization rate can be identified, providing data support for subsequent optimization. Identifying utilization rate information can help reasonably allocate computing tasks, effectively utilize idle cores, and improve overall system performance and energy efficiency. By analyzing the running frequency data, we can identify the high-frequency and low-frequency running patterns, help understand the CPU performance under different loads, and the analysis results can be used to formulate energy-saving strategies to reduce the running frequency and energy consumption when the load is low. By performing intersection operations on high-usage and high-frequency running data, we can identify high-energy-consuming running situations and help locate optimization points. The identified high-energy-consuming running data can prompt managers to take measures to optimize energy consumption and reduce operating costs. Performing intersection operations on low-usage and low-frequency running data can help identify high-efficiency running states and support energy-saving management. This process helps optimize resource allocation and ensure that the CPU runs in the most energy-efficient state when the load is low. By integrating high-energy and low-energy running data, we can form a comprehensive understanding of the overall energy consumption of the CPU, providing a basis for subsequent optimization. The integrated data helps to manage energy consumption more efficiently, ensure the rational use of resources, and improve energy efficiency. Mapping energy consumption data according to the CPU core load distribution temperature data helps to analyze the relationship between temperature and energy consumption and provide deeper insights. Through temperature mapping, we can optimize heat dissipation design and management, reduce overheating risks, and improve system stability and security.

[0063] Optionally, step S34 is specifically:

[0064] Step S341: extracting storage read / write features according to storage load data, thereby obtaining storage read / write data;

[0065] Step S342: performing I / O operation concurrency calculation according to the stored read / write data, thereby obtaining I / O operation concurrency data;

[0066] Step S343: performing storage load temperature statistics on the storage load data according to the temperature sensing data, thereby obtaining storage load temperature data;

[0067] Step S344: performing system performance evaluation on the I / O operation concurrency data to obtain system performance data;

[0068] Step S345: performing storage energy consumption statistics according to the system performance data, thereby obtaining computer storage energy consumption data;

[0069] Step S346: temperature mapping the computer storage energy consumption data according to the storage load temperature data, thereby obtaining storage energy consumption temperature data.

[0070] The present invention can obtain basic read and write performance data of storage devices by extracting storage read and write characteristics, providing reference for subsequent analysis. This process provides data support for further analysis of performance bottlenecks and optimization of storage systems. By calculating the concurrency of I / O operations, the responsiveness of storage systems under high loads can be evaluated, helping to identify potential performance bottlenecks. Understanding the concurrency of I / O operations helps to reasonably configure storage resources and ensure that good performance can be maintained under high concurrency. By counting the temperature data of storage loads, the temperature changes of storage devices under different loads can be monitored to help identify overheating problems. The temperature statistics can be used to optimize the heat dissipation design of storage systems, ensure that the equipment runs within a safe temperature range, and extend the life of hardware. System performance evaluation of I / O operation concurrency data can fully understand the performance of storage systems under different workloads. The evaluation results provide decision support for system performance optimization and resource management, and help to formulate more effective operation strategies. According to system performance data, storage energy consumption is counted, and the energy consumption performance of storage systems under different loads and usage conditions can be analyzed, providing data support for energy-saving management. By understanding storage energy consumption, it helps enterprises make more cost-effective decisions in storage management and reduce operating costs. Mapping storage energy consumption data based on storage load temperature data can help analyze the relationship between temperature and energy consumption and provide deeper insights. This mapping helps optimize the thermal design and energy efficiency management of the storage system to ensure optimal energy consumption performance under different temperature conditions.

[0071] Optionally, step S4 is specifically:

[0072] Step S41: performing time distribution calculation according to the computer operation energy consumption data and the computer communication vulnerability data, thereby obtaining operation energy consumption time distribution data and communication vulnerability time distribution data;

[0073] Step S42: performing time distribution overlap statistics according to the operation energy consumption time distribution data and the communication vulnerability time distribution data, thereby obtaining time distribution overlap data;

[0074] Step S43: extracting computer vulnerability features according to the time distribution overlap data, thereby obtaining computer vulnerability data;

[0075] Step S44: performing vulnerability attack pattern statistics according to the computer vulnerability data, thereby obtaining vulnerability attack pattern data;

[0076] Step S45: construct an intrusion detection system according to the vulnerability attack pattern data, thereby obtaining intrusion detection system data.

[0077] The present invention can integrate the time-varying trends of the two data by calculating the time distribution of computer operation energy consumption data and communication vulnerability data, and provide basic data for subsequent analysis. The time distribution data can help identify the time period when the energy consumption peak and the vulnerability appear, which is convenient for targeted security monitoring and resource allocation. By statistically analyzing the overlap of the operation energy consumption time distribution and the communication vulnerability time distribution, the correlation between the energy consumption peak and the vulnerability appearance can be identified, thereby revealing potential security risks. High overlap indicates that there is a higher attack risk in a specific period of time, which enhances the early warning ability of the system and enables the security team to take preventive measures in advance. By extracting vulnerability features, the types and features of vulnerabilities in the system can be fully understood, providing data support for vulnerability management and repair. The extracted vulnerability data can help identify the potential attack surface of the system, which is convenient for formulating corresponding security policies. By statistically analyzing the attack mode of computer vulnerabilities, common attack methods and patterns can be identified, providing guidance for subsequent security protection. By understanding the attack mode, the security team can formulate more targeted protective measures to effectively reduce the risk of being attacked. Building an intrusion detection system based on vulnerability attack pattern data can monitor and identify abnormal activities in real time and enhance the security protection capabilities of computer systems. The intrusion detection system can automatically issue an alarm when suspicious activities are detected, and even take automatic response measures to improve the system's security response speed.

[0078] Optionally, the present specification further provides a computer device, which includes a computer device main body, a power supply unit and an electrical control unit, wherein the power supply unit is installed inside the computer device main body, the electrical control unit is electrically connected to the power supply unit, and the electrical control unit is used to charge the computer device main body and control the computer device main body, and the electrical control unit includes:

[0079] Information security model building module: used to obtain computer equipment information data, and extract security policy data based on the computer equipment information data, thereby obtaining security policy data; construct a computer information security topology structure model based on the security policy data, thereby obtaining a computer information security topology structure model;

[0080] Communication risk classification module: used to extract computer communication data according to computer equipment information data, thereby obtaining computer communication data; perform communication risk analysis according to computer communication data, thereby obtaining communication risk data; perform communication risk classification on the computer information security topology structure model according to the communication risk data, thereby obtaining a computer communication risk topology structure model;

[0081] Communication vulnerability detection module: used to obtain computer equipment operation logs, and perform computer energy consumption analysis based on computer equipment operation logs, thereby obtaining computer operation energy consumption data; perform communication vulnerability detection on computer communication data based on the computer communication risk topology model, thereby obtaining computer communication vulnerability data;

[0082] Intrusion detection system construction module: used to perform correlation analysis based on computer operation energy consumption data and computer communication vulnerability data, so as to obtain computer communication vulnerability energy consumption correlation data; construct an intrusion detection system based on computer communication vulnerability energy consumption correlation data, so as to obtain intrusion detection system data;

[0083] Communication security monitoring module: used to perform communication operation security monitoring on computer equipment information data according to the intrusion detection system, so as to obtain communication operation security data and upload it to the computer equipment management cloud platform to perform computer communication security operation tasks.

[0084] A computer device of the present invention can implement any computer operation method of the present invention, and is used to combine the operation and signal transmission medium between various modules to complete a computer operation method. The internal modules of the device cooperate with each other, thereby improving the security of computer communication operation. BRIEF DESCRIPTION OF THE DRAWINGS

[0085] Other features, objects and advantages of the present invention will become more apparent from the detailed description of non-limiting embodiments thereof made with reference to the following drawings:

[0086] Figure 1 A schematic flow chart of the steps of the computer device operation method of the present invention;

[0087] Figure 2 Detailed step flow diagram of step S1 in the present invention;

[0088] Figure 3 Detailed step flow diagram of step S2 in the present invention.

[0089] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0090] The following is a clear and complete description of the technical method of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by technicians in this field without creative work are within the scope of protection of the present invention.

[0091] In addition, the accompanying drawings are only schematic illustrations of the present invention and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. The functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different network and / or processor methods and / or microcontroller methods.

[0092] It should be understood that, although the terms "first", "second", etc. may be used herein to describe various units, these units should not be limited by these terms. These terms are used only to distinguish one unit from another unit. For example, without departing from the scope of the exemplary embodiments, the first unit may be referred to as the second unit, and similarly the second unit may be referred to as the first unit. The term "and / or" used herein includes any and all combinations of one or more of the listed associated items.

[0093] To achieve this, please refer to Figures 1 to 3 The present invention provides a computer device operation method, the method comprising the following steps:

[0094] Step S1: Acquire computer device information data, and extract security policy data based on the computer device information data, thereby obtaining security policy data; construct a computer information security topology structure model based on the security policy data, thereby obtaining a computer information security topology structure model;

[0095] In this embodiment, in the process of obtaining computer device information data, the detailed configuration of the device is collected through the system interface or hardware sensor, including hardware information such as processor, memory, hard disk, network adapter, and operating system, installed software and running service information. These data are collected in real time through standardized data interfaces and stored in the database as the basis for subsequent analysis. Subsequently, based on these device information, the device is security assessed using a predefined security policy template. The security policy data is generated by comparing the existing security specification library and combining the actual configuration of the device to ensure the optimal security of the device in a specific operating scenario. Then, a computer information security topology model is constructed using these security policy data. The model visualizes the security level of each device node, communication link, and data flow, reflecting the security association relationship of each node in the entire system. Through this topological model, the security structure and potential risk points in the computer system can be intuitively displayed, which is convenient for subsequent operations.

[0096] Step S2: extracting computer communication data according to the computer device information data, thereby obtaining computer communication data; performing communication risk analysis according to the computer communication data, thereby obtaining communication risk data; dividing the computer information security topology structure model according to the communication risk data, thereby obtaining a computer communication risk topology structure model;

[0097] In this embodiment, based on the computer device information data, the communication data of the device is extracted from the network communication log, including information such as the transmission protocol, destination IP address, port number, transmission time, and packet size. These communication data are summarized by real-time analysis tools and filtered by a specific rule base to screen out risky communication behaviors. Based on these communication data, a detailed communication risk analysis is performed, including security risks such as abnormal traffic detection, unauthorized access, and communication interruption. Through the analysis of these communication risks, different types of security risk events are extracted, and these risk events are mapped to the previously constructed computer information security topology model. Each node in the model will be divided according to the communication risk, and the risk level and security protection requirements of each node are identified to form a computer communication risk topology model. This model shows the specific risks faced by different nodes in the system and potential communication vulnerabilities.

[0098] Step S3: obtaining computer equipment operation logs, and performing computer energy consumption analysis based on the computer equipment operation logs, thereby obtaining computer operation energy consumption data; performing communication vulnerability detection on computer communication data based on the computer communication risk topology structure model, thereby obtaining computer communication vulnerability data;

[0099] In this embodiment, the process of obtaining the operation log of the computer device is completed by calling the system log recording tool, including log information such as the device operation status, process management, and resource usage. These data are stored and analyzed to evaluate the operating performance and energy consumption of the device. According to these logs, the utilization rate of the CPU, memory, and hard disk of the device under different load conditions is analyzed to obtain the operating energy consumption data of the device. At the same time, based on the computer communication risk topology model, the computer communication data is deeply detected through deep data packet analysis (DPI) to find existing communication vulnerabilities, such as protocol anomalies, transmission errors, etc. A detailed communication vulnerability report is generated by extracting and sorting the vulnerability data. This report not only points out the security risks of the device during the communication process, but also analyzes the impact of these vulnerabilities on the energy consumption of the device, providing a reference for subsequent operations.

[0100] Step S4: performing correlation analysis based on the computer operation energy consumption data and the computer communication vulnerability data, thereby obtaining computer communication vulnerability energy consumption correlation data; constructing an intrusion detection system based on the computer communication vulnerability energy consumption correlation data, thereby obtaining intrusion detection system data;

[0101] In this embodiment, through the correlation analysis of computer operation energy consumption data and communication vulnerability data, the data of the peak energy consumption period of the equipment is extracted and compared with the communication vulnerability data. Through this step of operation, it is possible to clearly identify whether the energy consumption anomaly is correlated with the communication vulnerability. If the energy consumption data of the device increases significantly when a communication vulnerability occurs, it means that the communication vulnerability is related to the high energy consumption of the device. This correlation data is further statistically analyzed to generate an energy consumption vulnerability correlation report. Based on this correlation data, a real-time intrusion detection system (IDS) is constructed, which monitors the system security according to the real-time communication status and energy consumption of the device. Through rule base matching and real-time analysis functions, IDS can quickly identify and prevent potential communication vulnerability attacks, improve the security protection capabilities of the device, and effectively reduce the excessive energy consumption caused by attacks.

[0102] Step S5: Perform communication operation security monitoring on computer equipment information data according to the intrusion detection system to obtain communication operation security data, and upload it to the computer equipment management cloud platform to execute computer communication security operation tasks.

[0103] In this embodiment, with the support of the intrusion detection system, the real-time communication data of the device is continuously monitored. By analyzing abnormal behaviors in device communications, such as unauthorized access, abnormal data packet traffic, etc., the intrusion detection system can promptly alarm and take protective measures. The communication operation security data generated by the system is uploaded to the device management cloud platform through a secure link. The cloud platform summarizes and analyzes the communication security data of all monitored devices, and uniformly manages and optimizes security policies. At the same time, the cloud platform provides real-time warnings and security operation instructions based on the security status of different devices, such as immediately patching communication vulnerabilities, adjusting firewall rules, etc. Through this mechanism, it is possible to ensure that the communication security of the device is maintained in a timely and effective manner, and that the device's operating tasks can be stably executed in a secure environment, avoiding security risks caused by communication vulnerabilities.

[0104] Optionally, step S1 specifically includes:

[0105] Step S11: acquiring computer device information data, and extracting security policy data according to the computer device information data, thereby obtaining security policy data;

[0106] In this embodiment, the computer device information data is obtained by accessing the computer system's hardware configuration, operating system version, network connection status, open ports, installed software and other information, and using tools based on the underlying system API to collect device information data. These data are collected in real time through automated scripts and stored in a database. Security policy data extraction is performed based on existing security configuration files, and these device information data are analyzed using predefined security standards and procedures to extract relevant security policy data. For example, whether the operating system version is outdated, whether there are unpatched security vulnerabilities, whether the security of the network connection meets the expected standards, etc. These data are stored and compared with the relevant policy library to generate a security policy set corresponding to the actual situation of the device for use in subsequent steps.

[0107] Step S12: classifying the security policy hierarchy according to the security policy data, thereby obtaining the network layer security policy and the application layer security policy;

[0108] In this embodiment, the implementation of security policy hierarchical classification is to divide the extracted security policy data into network layer security policy and application layer security policy according to the security requirements of different levels. The network layer security policy includes network routing configuration, firewall rules, network traffic control and other contents, and the application layer security policy includes application access control policy, data encryption measures and identity authentication mechanism and other contents. The classification process matches and classifies the extracted policy data according to the normative standards of different security levels, ensuring that each policy can be processed and configured separately for different levels, thereby maximizing the security and adaptability of each level.

[0109] Step S13: constructing routing nodes according to the network layer security policy, thereby obtaining routing node data;

[0110] In this embodiment, the construction of the routing node is based on the network configuration and routing rules specified in the network layer security policy to identify each routing node in the device. By parsing the network layer protocol information, each routing node in the network and its corresponding IP address, subnet mask, gateway and other configuration data are obtained. These routing node data are collected in real time by a network monitoring tool (such as Wireshark), and the detailed configuration of the routing node is generated by the network analysis module. In this process, the security of network flow control and data packet routing also needs to be considered to ensure that the network layer security policy is strictly implemented. After the construction is completed, the system will generate a detailed list of routing node data for subsequent operations.

[0111] Step S14: constructing a firewall node according to the application layer security policy, thereby obtaining firewall node data;

[0112] In this embodiment, the construction of the firewall node is based on the firewall rules defined in the application layer security policy, combined with the network interface configuration of the computer device, to determine the location and function of the firewall node. By reading the firewall settings of the device (such as iptables or Windows Firewall), the access control list, packet filtering rules, port number restrictions and other information in the application layer security policy are applied to each network interface of the device. The firewall node data is verified through the firewall log file to ensure that the communication of each application and service complies with the established policy requirements. The execution result of this step is to generate a set of node data for configuring the firewall, indicating the specific configuration and function of each firewall node.

[0113] Step S15: performing computer node spatial fusion according to the routing node data and the firewall node data, thereby obtaining computer node data;

[0114] In this embodiment, the spatial fusion of computer nodes is achieved by integrating the routing node data and firewall node data obtained in the early stage to establish a comprehensive computer node representation system. The specific implementation steps include integrating and calculating the network location, functional role and relationship with other nodes of each node to construct a communication topology structure between nodes. In this process, the data of all nodes are integrated into a unified node database, and a special network topology analysis tool is used to visualize it for subsequent operations. Computer node data includes information such as the node's IP address, physical location, and connection relationship with other nodes, which is a specific description of the device communication network structure.

[0115] Step S16: Performing computer node communication connection on the computer node data according to the security policy data, thereby obtaining computer node communication data;

[0116] In this embodiment, in the process of performing communication connection operation on computer node data according to security policy data, the connection between each node is defined through network communication protocol (such as TCP / IP protocol). This process mainly relies on routing tables and firewall rules to ensure that the communication between each node complies with the predefined security policy. The communication connection operation is controlled by an automated script, which gradually establishes the communication path between nodes and detects the security and data integrity of the transmission in real time. The computer node communication data generated in this step records the communication path, data transmission protocol, transmission bandwidth and other information between each node, ensuring that the communication of each node in the system is safe and controllable.

[0117] Step S17: constructing a computer information security topology structure model according to the computer node data and the computer node communication data, thereby obtaining a computer information security topology structure model.

[0118] In this embodiment, the construction of the computer information security topology model is generated based on computer node data and communication data. In this process, the topology analysis algorithm is used to integrate the physical location, functional role and communication relationship of all nodes into a global model to generate a comprehensive topology diagram. The topology model not only shows the communication path between devices, but also identifies the security level and potential risk points of each node, which is convenient for risk assessment and security monitoring. Through this structural model, the system can identify the communication flow of each node during actual operation, and dynamically adjust according to the actual communication situation to ensure the communication security and network reliability of computer equipment.

[0119] Optionally, step S2 specifically includes:

[0120] Step S21: extracting computer communication data according to computer device information data, thereby obtaining computer communication data;

[0121] In this embodiment, computer communication data is extracted based on computer device information data, and the real-time communication behavior of the computer is captured by deploying network traffic monitoring tools at the device level. These tools use deep packet inspection technology to monitor all network traffic in and out of the computer. By analyzing the device information data, the source of the data is determined, including the source IP address, destination IP address, transmission protocol type, port number, etc. These communication data will be collected and sorted through the logging system and stored in a dedicated data warehouse for further analysis. During the extraction process, the status and transmission rate of each connection will be tracked in real time, and all communications will be recorded to ensure the integrity and accuracy of the data extraction.

[0122] Step S22: performing a request service risk analysis based on the computer communication data, thereby obtaining request service risk data;

[0123] In this embodiment, the request service risk analysis is performed by counting and analyzing the service request behavior in the extracted computer communication data. The system identifies the type of service requested by the device by analyzing the transmitted data packets, including network services such as HTTP, DNS, and FTP. Then, by detecting phenomena such as abnormal request frequency, service unavailability, or service response delay, the potential risks in the service request process are evaluated. The request service risk analysis uses machine learning algorithms to identify behavioral patterns. By establishing a normal communication baseline, it identifies abnormal service request behaviors, determines whether there are malicious requests or denial of service attacks, and records related risk events. Each request service risk will be marked and stored in the risk data file as a basis for further integrated analysis.

[0124] Step S23: performing data leakage risk analysis based on computer communication data to obtain data leakage risk data;

[0125] In this embodiment, data leakage risk analysis monitors and analyzes the transmission behavior of sensitive information in computer communication data to identify leakage events. The specific implementation method is to match and check the data information transmitted through the network by setting data leakage detection rules. This process uses regular expressions and predefined leakage rules to analyze all data streams transmitted during the communication process and detect unauthorized data transmission behavior in real time. If sensitive data is found to be transmitted through the public network without encryption, the system will mark the behavior as a data leakage risk and generate a detailed risk report, including the leaked data content, transmission time and transmission path.

[0126] Step S24: integrating communication risk data according to the denial of service attack risk data and the data leakage risk data, thereby obtaining communication risk data;

[0127] In this embodiment, the communication risk data integration is to conduct a unified comprehensive analysis of the denial of service attack risk data and the data leakage risk data to generate overall communication risk data. The denial of service attack risk data comes from the previous service request risk analysis, which records all abnormal service requests and attack behaviors. The data leakage risk data comes from abnormal sensitive information leakage events found during data transmission. The communication risk data integration process analyzes the correlation between time, space and behavior patterns of various risk events, finds the correlation between them, and generates a comprehensive report containing the overall communication risk. The report not only contains different types of risks, but also clearly identifies the location and potential impact of each risk, which is convenient for subsequent processing and protection.

[0128] Step S25: performing communication risk classification on the computer security topology structure model according to the communication risk data, thereby obtaining a computer communication risk topology structure model.

[0129] In this embodiment, the communication risk division is to refine and identify the existing computer security topology structure based on the integrated communication risk data. In the specific implementation process, the system divides all risk data according to the network level and device functional area, and identifies and classifies high-risk areas and low-risk areas. The communication risk division combines the function and importance of each node, and annotates the entire topology structure according to the potential threat level, so that the risk level of each area is clear at a glance. The final generated computer communication risk topology model contains a detailed visual representation of communication paths, nodes, and risk areas, which provides clear guidance for subsequent security management and defense, and supports real-time updates and dynamic adjustments.

[0130] Optionally, step S22 is specifically:

[0131] Step S221: extracting communication flow characteristics according to computer communication data, thereby obtaining communication flow data;

[0132] In this embodiment, communication traffic feature extraction is to process computer communication data through network traffic analysis tools to analyze the traffic pattern of each network connection. The traffic monitoring module captures all inbound and outbound traffic on the network interface, analyzes the characteristics of data packet transmission rate, packet size, transmission direction, etc. in each session, and identifies the traffic behavior of different communication protocols (such as TCP, UDP). Subsequently, the system preprocesses the collected raw traffic data, including denoising and filtering non-essential data to ensure the accuracy of communication traffic features. The feature extraction tool will classify the traffic pattern and extract key information, and finally form communication traffic data, which will be used for subsequent analysis to ensure that it can accurately reflect the communication situation of the current network.

[0133] Step S222: decoding the communication traffic data into packets, thereby obtaining packet decoding data;

[0134] In the present embodiment, the packet decoding operation is performed in detail to each packet in the captured communication flow data by a packet analysis tool. Using a packet decoding tool such as Wireshark, each packet in the flow is decoded at the protocol level. The process includes extracting the packet header information, parsing the port number, source IP address and destination IP address of the transport layer protocol (such as TCP, UDP), analyzing the network layer data (such as IP header) and application layer data (such as HTTP, FTP protocol content). The decoded data will record the structure, content and purpose of each packet in detail. Through the decoded data, the transmission path, protocol type and content format of the packet can be identified, forming packet decoding data for subsequent processing.

[0135] Step S223: performing handshake behavior statistics of the data packets according to the decoded data of the data packets, thereby obtaining handshake data packets and non-handshake data packets;

[0136] In this embodiment, the data packet handshake behavior statistics are based on the decoded data packet information to track and analyze the handshake behavior of each TCP connection. The system determines whether each connection has successfully completed the handshake by detecting the three-way handshake process of the Transmission Control Protocol (TCP). The specific steps include monitoring the sending and receiving order of SYN (synchronization) packets, SYN-ACK (synchronization confirmation) packets, and ACK (confirmation) packets to determine the status of the connection. For connections that successfully complete the three-way handshake, they are marked as handshaked data packets, and the source IP, destination IP and port information of these data packets are recorded; for connections that do not complete the handshake, they are recorded as unhandshaked data packets. The handshaked and unhandshaked data packet data are stored separately and used for subsequent statistical analysis.

[0137] Step S224: performing data packet transmission frequency statistics according to the data packet decoding data, thereby obtaining high-frequency data packet transmission data and low-frequency data packet transmission data;

[0138] In this embodiment, the packet transmission frequency statistics is to analyze the decoded data packets according to their transmission frequency. The system measures the data packet transmission rate between each source and destination IP address and counts the number of packets sent per second. By calculating the transmission interval of the data packet, the communication behaviors of high-frequency transmission and low-frequency transmission are distinguished. High-frequency data packet transmission represents a large amount of data transmission or attack behavior in a short period of time, such as a denial of service attack, while low-frequency data packet transmission is associated with normal communication or requests under low load conditions. Based on the statistical results of the transmission frequency, the analysis tool divides the high-frequency and low-frequency transmission data into two independent data sets, and stores them by category for further processing.

[0139] Step S225: performing a false request service intersection operation according to the high-frequency data packet transmission data and the unhandshake data packet data, thereby obtaining false request service data;

[0140] In this embodiment, the intersection operation of the false request service is to identify potential false service requests by cross-matching the high-frequency data packet sending data and the unhandshake data packet data. The system screens out the connections that are frequently sent and have not completed the handshake from the high-frequency data packet sending data, and then compares the transmission path and port information in the unhandshake data packet to confirm whether these frequently sent data packets involve false requests. False requests are manifested as a large number of SYN packets sent, but there is no response packet for the subsequent handshake completion. Through the cross operation, the false request service data is finally obtained, which contains request records for launching denial of service attacks or other malicious behaviors.

[0141] Step S226: performing a real request service intersection operation according to the low-frequency data packet transmission data and the handshake data packet data, thereby obtaining real request service data;

[0142] In this embodiment, the intersection operation of the real request service identifies normal service requests by analyzing the association between the low-frequency data packet sending data and the handshake data packet. The system extracts the communication records at the normal transmission rate from the low-frequency data packet sending data, and compares it with the handshake data packet information to confirm whether these communication requests have successfully completed the three-way handshake. By comparing the handshake data and the low-frequency data packet sending records, the system can distinguish the communication connections that have been successfully established and mark them as real request service data. This type of data represents the user's normal access requests or other legitimate communication behaviors, and is regarded as a low-risk connection in security management.

[0143] Step S227: integrating the request service risk according to the false request service data and the real request service data, thereby obtaining the request service risk data.

[0144] In this embodiment, the request service risk integration is to conduct a comprehensive analysis of the false request service data and the real request service data to generate the overall request service risk data. The system prioritizes the false request service data, evaluates the threat level of each false request, and performs correlation analysis on the real request service data to determine whether the real request is interfered with or has potential risks. The system generates a request service risk report based on the frequency of false request services, the number of incomplete handshakes, and the related source IP behavior patterns, combined with the service stability of the real request. The report contains the detailed information and risk levels of all risk connections, and finally forms complete request service risk data for further security policy formulation and network protection.

[0145] Optionally, step S23 is specifically:

[0146] Step S231: extracting transmission data features according to computer communication data, thereby obtaining transmission data;

[0147] In this embodiment, the transmission data feature extraction obtains the transmission characteristics of each data packet by performing in-depth analysis on the computer communication data. The system captures the communication data coming in and out of the computer network in real time by monitoring the network interface. These data include characteristics such as transmission protocol, data packet size, and packet transmission rate at the network level. During the extraction process, the system will classify the data, divide the data set according to the transmission protocol (such as TCP, UDP, HTTP, etc.), and mark the source IP, target IP, transmission port, transmission direction and other information of each data packet. By analyzing these features, transmission data is generated for subsequent processing. This step provides basic data for subsequent protocol identification and anomaly detection.

[0148] Step S232: performing transmission protocol identification on the transmission data, thereby obtaining data transmission protocol data;

[0149] In this embodiment, the transport protocol identification determines the transport protocol used by analyzing the header information of each data packet in the transmission data. The system performs protocol parsing on each captured data packet and extracts key information from the data packet header, such as source port, destination port, identifier, and protocol flag field. The system identifies the protocol (such as TCP, UDP, ICMP, etc.) used by each data packet by matching these fields with the standard protocol features in the known protocol library. This process is implemented by the protocol parser module, which can identify common network transmission protocols and generate data transmission protocol data. This data will be used for subsequent protocol field statistics and anomaly detection.

[0150] Step S233: performing protocol field statistics according to the data transmission protocol data, thereby obtaining abnormal protocol field data;

[0151] In this embodiment, the protocol field statistics analyze and count each field in the transmission protocol to identify abnormal fields in the protocol data. Based on the identified protocol data, the system will perform statistical analysis on the protocol header fields of each data packet, including source IP, destination IP, port number, sequence number, confirmation number, flag bit and other information. By analyzing the numerical range of these fields and the frequency of their occurrence, the system can identify abnormal fields that do not conform to standard protocol behavior. For example, if the sequence number and confirmation number in the TCP protocol do not match, it indicates the presence of malicious attack behavior. Abnormal protocol field data is recorded at this stage and serves as a key basis for subsequent data leakage detection.

[0152] Step S234: performing transmission time statistics according to the transmission data, thereby obtaining abnormal transmission time data;

[0153] In this embodiment, transmission time statistics measure and record the transmission time of each data packet to identify abnormal transmission behavior. The system accurately measures the sending and receiving time of each data packet, calculates the transmission time interval, and counts the data transmission frequency and delay of each connection. The system compares these transmission times with the time reference in the normal communication mode to identify abnormal delays or too fast transmissions. Abnormal transmission time means potential data leakage or attack behavior. For example, a sudden transmission of a large number of data packets is a manifestation of data leakage. Abnormal transmission time data is recorded in this step for subsequent intersection operations.

[0154] Step S235: performing data leakage intersection operation according to the abnormal protocol field data and the abnormal transmission time data, thereby obtaining data leakage data;

[0155] In this embodiment, the data leakage intersection operation detects data leakage behavior by correlating and analyzing the abnormal protocol field data with the abnormal transmission time data. The system will match the abnormal protocol field identified in the previous step with the abnormal transmission time, and compare whether these abnormal features occur in the same data stream. Through the intersection operation, the system can identify suspicious data flows that have both abnormal protocol fields and abnormal transmission time features, and mark these data flows as potential data leakage events. The system further analyzes the source and purpose of these suspicious flows to determine the data leakage behavior involved. The data leakage data generated in this step records all transmission records suspected of leakage.

[0156] Step S236: Perform risk assessment based on the data leakage data to obtain data leakage risk data.

[0157] In this embodiment, the data leakage risk assessment further analyzes and classifies the identified data leakage data to assess its threat level to system security. The system will conduct a detailed risk assessment based on the scale of the leaked data, the type of sensitive data leaked, and the frequency of occurrence. The assessment process includes tracing the source of each leakage event, analyzing the data content, and its impact on the overall system. The risk assessment tool will classify the incident according to the severity of the leakage, for example, determining its risk level based on whether the leaked content involves sensitive data (such as identity information or financial data). Ultimately, data leakage risk data is generated as a basis for the system to take further protective measures.

[0158] Optionally, step S3 specifically includes:

[0159] Step S31: obtaining a computer device operation log, and performing temperature sensing feature extraction according to the computer device operation log, thereby obtaining temperature sensing data;

[0160] In this embodiment, the acquisition of the computer device operation log is performed through a system log management tool. Use tools such as EventViewer (Windows) or syslog (Linux) to extract the system operation log from the computer device. These logs include operation records, error messages, warnings, and system events of the device. These log data are processed by log analysis tools (such as Splunk or ELKStack) to extract data related to the temperature sensor. Temperature sensing feature extraction includes analyzing the data fields recorded by the temperature sensor in the system, such as CPU temperature, GPU temperature, hard disk temperature, etc. By cleaning and integrating these temperature data, the temperature sensing data obtained includes the reading, timestamp, and temperature change of each sensor, providing basic data for subsequent analysis.

[0161] Step S32: obtaining CPU load data and storing the load data;

[0162] In this embodiment, obtaining CPU and storage load data is completed through system monitoring tools. Use TaskManager (Windows) or top / htop (Linux) to monitor and record CPU usage in real time. Use iostat (Linux) or PerformanceMonitor (Windows) to monitor storage load. The collected data includes the current load percentage of the CPU, the number of processing threads, the read and write rate of the storage device, the number of I / O operations, etc. These data will be stored in log files and summarized and processed by data analysis tools (such as Prometheus or Grafana). By analyzing these load data, a comprehensive understanding of the load of computer equipment can be provided, preparing for further energy consumption analysis.

[0163] Step S33: performing CPU energy consumption analysis on the CPU load data according to the temperature sensing data, thereby obtaining CPU energy consumption temperature data;

[0164] In this embodiment, the CPU energy consumption analysis is performed by combining the temperature sensor data with the CPU load data. The temperature sensor data is aligned with the CPU load data, and the temperature record corresponding to each load change is matched according to the timestamp. Then, the temperature data is converted into energy consumption data using the known CPU temperature-energy consumption relationship model. The specific method includes applying linear regression analysis to estimate the energy consumption through the temperature change of the CPU. For example, when the CPU temperature rises, it can be assumed that its energy consumption increases, and the energy consumption temperature data of the CPU is calculated by a formula. These data help evaluate the energy efficiency performance of the CPU under different workloads.

[0165] Step S34: performing storage energy consumption analysis on the storage load data according to the temperature sensing data, thereby obtaining storage energy consumption temperature data;

[0166] In this embodiment, storage energy consumption analysis is completed by comprehensively analyzing temperature sensor data and storage load data. Collect temperature sensor data of storage devices and their corresponding load data. Use device monitoring tools, such as smartctl (for hard disk health monitoring), to obtain temperature and load information. Integrate and compare these data to calculate the energy consumption under storage load. The specific analysis includes matching storage temperature data with load data, using a model similar to CPU energy consumption analysis, predicting the energy consumption of storage devices through temperature changes, and generating storage energy consumption temperature data. This data can be used to optimize the operation and cooling strategy of storage devices.

[0167] Step S35: integrating the computer operation energy consumption data according to the CPU energy consumption temperature data and the storage energy consumption temperature data, thereby obtaining the computer operation energy consumption data;

[0168] In this embodiment, the computer operation energy consumption data is integrated by summarizing the CPU energy consumption temperature data and storage energy consumption temperature data obtained in steps S33 and S34. The CPU energy consumption temperature data and the storage energy consumption temperature data are aligned in time. Next, the two data sets are merged, and data aggregation and statistical analysis are performed using a data integration tool (such as the Pandas data analysis library). By calculating the total energy consumption, the overall energy consumption data of the computer device in a specific time period is obtained. The integrated computer operation energy consumption data provides an overview of the energy consumption of the device under different load conditions, helping to formulate a more efficient energy management strategy.

[0169] Step S36: Perform communication vulnerability detection on computer communication data according to the computer communication risk topology structure model, thereby obtaining computer communication vulnerability data.

[0170] In this embodiment, computer communication vulnerability detection is completed by using a computer communication risk topology model to detect computer communication data. The computer communication data is imported into a security analysis tool (such as Wireshark or Bro / Zeek) for detailed protocol analysis and traffic detection. The risk topology model is used to monitor data traffic in real time to identify potential vulnerabilities. For example, by comparing normal and abnormal traffic patterns through the model, abnormal behaviors such as unexpected traffic patterns, abnormal data packet types, etc. are detected. Finally, computer communication vulnerability data is generated, and communication traffic with vulnerabilities is marked to help identify and repair potential security threats.

[0171] Optionally, step S33 is specifically:

[0172] Step S331: extracting CPU core load distribution features according to the CPU load data, thereby obtaining CPU core load distribution data;

[0173] In this embodiment, the CPU core load distribution feature extraction is performed by analyzing the collected CPU load data in detail. Use system performance monitoring tools such as top or htop (Linux) or PerformanceMonitor (Windows) to extract the load data of each core. The data includes the utilization rate of each CPU core, the number of processing threads and the load balancing situation. Use data processing scripts (such as the Pandas library in Python) to calculate the load distribution characteristics of each core. After integrating the load data of all cores, the CPU core load distribution data is generated. These data reflect the load status of each core in different time periods, providing a basis for further analysis.

[0174] Step S332: Calculate the core load utilization rate and the operating frequency according to the CPU core load distribution data, thereby obtaining the core load utilization rate data and the CPU operating frequency data;

[0175] In this embodiment, the core load utilization and CPU operating frequency are calculated based on the CPU core load distribution data. The utilization and operating frequency data of each CPU core are collected using the top or htop monitoring tool. These data are imported into the data analysis tool for statistical calculation. The core load utilization is calculated by taking the average load percentage of each core within a specified time interval. The calculation of the operating frequency involves recording the actual operating frequency (GHz) of each core and counting its changes. These calculation results generate core load utilization data and CPU operating frequency data respectively.

[0176] Step S333: collecting CPU core load distribution temperature data on the CPU core load distribution data according to the temperature sensing data, thereby obtaining the CPU core load distribution temperature data;

[0177] In this embodiment, the CPU core load distribution temperature data is collected by combining the temperature sensor data with the CPU load data. Use a hardware monitoring tool (such as lm-sensors (Linux) or HWMonitor (Windows)) to obtain the temperature data of each core. Align the temperature data with the CPU core load distribution data to ensure that the temperature and load data at the same time point match. Through the data sorting tool, the temperature data is combined with the load data, the relationship between the load and temperature of each core is calculated, and the CPU core load distribution temperature data is generated. These data provide detailed information on the impact of core temperature on load.

[0178] Step S334: performing usage statistics according to the core load usage data, thereby obtaining CPU high usage data and CPU low usage data;

[0179] In this embodiment, the usage statistics are based on the CPU core load usage data. By analyzing the load usage data of each core, the time periods of high usage and low usage are classified. High usage data is defined as records where the load usage exceeds a preset threshold, and low usage data is records below the threshold. Use data analysis tools (such as Excel or Pandas in Python) to classify and count the load usage, and calculate the frequency and duration of high usage and low usage. These data provide a detailed view for understanding the performance of the CPU under different load conditions.

[0180] Step S335: performing operating frequency statistics on the CPU operating frequency data, thereby obtaining CPU high-frequency operating data and CPU low-frequency operating data;

[0181] In this embodiment, the operating frequency statistics are completed by collecting the CPU operating frequency data. Use PerformanceMonitor or iostat tools to obtain the CPU operating frequency data. By analyzing these data, the high-frequency operating data and low-frequency operating data of the CPU are calculated. High-frequency operating data refers to records with a frequency exceeding a certain threshold, and low-frequency operating data refers to records with a frequency below the threshold. Using data processing tools, the operating frequency data is classified and counted, and high-frequency and low-frequency operating data are summarized. These data help evaluate the energy efficiency of the CPU at different frequencies.

[0182] Step S336: performing a high energy consumption operation intersection operation on the CPU high usage rate data and the CPU high frequency operation data, thereby obtaining the CPU high energy consumption operation data;

[0183] In this embodiment, the intersection operation of high-energy consumption operation data is performed by combining high-usage data and high-frequency operation data. The high-usage data in step S334 is matched with the high-frequency operation data in step S335. For the time period running at high usage and high frequency, a data intersection operation is performed to find records that meet both conditions. These records are considered to be high-energy consumption operation data. Use data processing tools (such as the NumPy library in Python) to perform intersection operations to generate a data set containing high-energy consumption operation data. This data set reflects the energy consumption of the CPU under high load and high frequency conditions.

[0184] Step S337: performing a low energy consumption operation intersection operation according to the CPU low usage rate data and the CPU low frequency operation data, thereby obtaining the CPU low energy consumption operation data;

[0185] In this embodiment, the intersection operation of low-energy operation data is performed by combining low-usage data and low-frequency operation data. The low-usage data in step S334 is matched with the low-frequency operation data in step S335. For the time period running at low usage and low frequency, a data intersection operation is performed to find records that meet both conditions. These records are considered to be low-energy operation data. An intersection operation is performed using a data processing tool to generate a data set containing low-energy operation data. This data set provides the energy consumption of the CPU under low load and low frequency conditions.

[0186] Step S338: integrating the CPU energy consumption relationship according to the CPU high energy consumption operation data and the CPU low energy consumption operation data, thereby obtaining the CPU energy consumption data;

[0187] In this embodiment, the CPU energy consumption relationship integration is performed by combining high-energy consumption operation data and low-energy consumption operation data. The high-energy consumption operation data obtained in step S336 is aggregated with the low-energy consumption operation data in step S337. The two are integrated using a data integration tool (such as a SQL database or the Pandas library in Python) to calculate the overall CPU energy consumption data. The generated data includes energy consumption comparisons under different working states, which helps analyze the energy efficiency performance of the CPU under various load and frequency conditions. These data are used to optimize the CPU's energy consumption management strategy.

[0188] Step S339: Perform energy consumption-temperature mapping on the CPU energy consumption data according to the CPU core load distribution temperature data, thereby obtaining the CPU energy consumption-temperature data.

[0189] In this embodiment, the CPU energy consumption temperature mapping is completed by combining the CPU energy consumption data in step S338 with the CPU core load distribution temperature data in step S333. The CPU energy consumption data is aligned with the temperature data to ensure that the energy consumption and temperature data at the same time point match. The temperature data is mapped to the energy consumption data through the temperature-energy consumption relationship model. For example, a linear regression model can be used to determine the impact of temperature on energy consumption. This mapping process is applied to all records to generate CPU energy consumption temperature data. The final data provides a detailed analysis of the impact of temperature changes on CPU energy consumption.

[0190] Optionally, step S34 is specifically:

[0191] Step S341: extracting storage read / write features according to storage load data, thereby obtaining storage read / write data;

[0192] In this embodiment, storage read and write feature extraction is completed by analyzing storage load data. Storage load data is obtained using storage performance monitoring tools (such as iostat, vmstat or DiskSpeed ​​tools). These tools record the read and write operation data of storage devices within a specific time period, including the number of reads and writes, the amount of reads and writes, etc. By writing scripts (such as Python scripts combined with the Pandas library) to process these data, storage read and write features such as read and write rates, delays, etc. are extracted. Ultimately, the generated storage read and write data will contain detailed statistical information for each read and write operation, providing a basis for subsequent analysis.

[0193] Step S342: performing I / O operation concurrency calculation according to the stored read / write data, thereby obtaining I / O operation concurrency data;

[0194] In this embodiment, the I / O operation concurrency calculation is performed by further analyzing the storage read-write data. Using the storage read-write data obtained in the previous step, the number of I / O operations performed simultaneously in the same time period is counted. The concurrency of I / O operations can be calculated using data analysis tools (such as Pandas or Excel in Python). For example, by analyzing the number of I / O operation requests in each time period, the peak and trough periods of concurrent requests are identified. Finally, I / O operation concurrency data is generated, reflecting the concurrent processing capability of the system under different load conditions.

[0195] Step S343: performing storage load temperature statistics on the storage load data according to the temperature sensing data, thereby obtaining storage load temperature data;

[0196] In this embodiment, the storage load temperature statistics are completed by combining the temperature sensor data with the storage load data. Use a temperature monitoring tool (such as lm-sensors or HWMonitor) to collect the temperature data of the storage device. Align these temperature data with the storage load data to ensure that the temperature data matches the storage load data at the same time point. Use a data processing tool (such as the Pandas library in Python) to combine the temperature data with the storage load data, perform statistical analysis, and generate storage load temperature data. These data show the temperature of the storage device under different load conditions.

[0197] Step S344: performing system performance evaluation on the I / O operation concurrency data to obtain system performance data;

[0198] In this embodiment, the system performance evaluation is completed by analyzing the I / O operation concurrency data. Use system performance monitoring tools (such as PerfMon, top or nmon) to obtain the overall performance data of the system, including CPU usage, memory usage and I / O load. Combine these performance data with the I / O operation concurrency data to perform system performance evaluation. For example, use data analysis tools to calculate performance indicators such as response time and throughput of the system under high concurrent I / O operations. Finally, generate system performance data that reflects the performance of the system under different concurrent loads.

[0199] Step S345: performing storage energy consumption statistics according to the system performance data, thereby obtaining computer storage energy consumption data;

[0200] In this embodiment, storage energy consumption statistics are performed based on system performance data. Use a storage energy consumption monitoring tool (such as PowerTrend or IntelPowerGadget) to record the energy consumption data of the storage device. By combining system performance data (such as CPU usage, I / O operation volume) with storage energy consumption data, the energy consumption of the storage device under different performance states is calculated. For example, the energy consumption changes of the system under high I / O concurrency are analyzed to calculate the energy consumption of the storage device. Finally, computer storage energy consumption data is generated to provide information about the energy efficiency performance of the storage device under various load conditions.

[0201] Step S346: temperature mapping the computer storage energy consumption data according to the storage load temperature data, thereby obtaining storage energy consumption temperature data.

[0202] In this embodiment, the storage energy consumption temperature mapping is completed by combining the storage load temperature data with the storage energy consumption data. The storage load temperature data is aligned with the storage energy consumption data to ensure that the temperature and energy consumption data at the same time point match. A data processing tool (such as the Scikit-learn library in Python or the R language) is used to establish a relationship model between temperature and energy consumption. Through this model, the temperature data is mapped to the energy consumption data to generate storage energy consumption temperature data. These data show the impact of storage device temperature on energy consumption and help optimize the operation and cooling strategy of the storage device.

[0203] Optionally, step S4 specifically includes:

[0204] Step S41: performing time distribution calculation according to the computer operation energy consumption data and the computer communication vulnerability data, thereby obtaining operation energy consumption time distribution data and communication vulnerability time distribution data;

[0205] In the present embodiment, the time distribution calculation involves extracting time information from the computer operation energy consumption data and the computer communication vulnerability data. Timestamps and energy consumption values ​​are obtained from the energy consumption data extracted from the computer operation energy consumption monitoring tool (such as PowerShell, EnergyStar or IntelPowerGadget). Next, timestamps and vulnerability types are extracted from the vulnerability data extracted from the communication vulnerability detection tool (such as Wireshark or Snort). By writing a Python script, these data are sorted and grouped according to timestamps using the Pandas library to generate time distribution data of energy consumption and vulnerabilities. For example, the total energy consumption per hour and the frequency of vulnerability events per hour are calculated to obtain the operation energy consumption time distribution data and the communication vulnerability time distribution data.

[0206] Step S42: performing time distribution overlap statistics according to the operation energy consumption time distribution data and the communication vulnerability time distribution data, thereby obtaining time distribution overlap data;

[0207] In this embodiment, the time distribution overlap statistics are completed by analyzing the overlap between the operating energy consumption time distribution data and the communication vulnerability time distribution data. The time distribution data is plotted into a time series graph to show the distribution of energy consumption and vulnerability events in different time periods. Data analysis tools (such as matplotlib or seaborn libraries in Python) are used to calculate the time overlap of energy consumption and vulnerability data. For example, the number of high energy consumption and high vulnerability events that occur simultaneously in each time period is counted, and the intersection ratio is calculated. Finally, the time distribution overlap data is generated to show the correlation between energy consumption changes and vulnerability events.

[0208] Step S43: extracting computer vulnerability features according to the time distribution overlap data, thereby obtaining computer vulnerability data;

[0209] In this embodiment, computer vulnerability feature extraction is completed by extracting important features from time distribution overlap data. Time distribution overlap data is used to analyze the key time periods of vulnerabilities, such as whether the high energy consumption period coincides with the peak of vulnerability activity. Feature indicators such as the frequency and duration of vulnerability occurrence and the degree of correlation with energy consumption are calculated using data analysis tools (such as the numpy library in Python). Vulnerability features are extracted, such as vulnerability types or attack modes within a specific time period. Finally, computer vulnerability data is generated to show the characteristics of vulnerability activities and their relationship with energy consumption.

[0210] Step S44: performing vulnerability attack pattern statistics according to the computer vulnerability data, thereby obtaining vulnerability attack pattern data;

[0211] In this embodiment, the vulnerability attack pattern statistics are completed by analyzing the vulnerability data extracted in step S43. The vulnerability types and frequencies in the computer vulnerability data are organized into a table form. Use data analysis tools (such as pandas or Excel in Python) to count the frequency of occurrence and attack patterns of different types of vulnerabilities. For example, analyze whether the attack patterns of different vulnerability types have specific time patterns, such as whether they occur frequently within a specific time period. By counting and analyzing these patterns, vulnerability attack pattern data is generated to reveal attack behavior patterns and their characteristics.

[0212] Step S45: construct an intrusion detection system according to the vulnerability attack pattern data, thereby obtaining intrusion detection system data.

[0213] In the present embodiment, the intrusion detection system is constructed based on the vulnerability attack pattern data. The rules and strategies of the intrusion detection system are defined, and the detection criteria are set according to the vulnerability attack pattern data. For example, if a certain attack pattern is found to occur frequently within a specific time period, the corresponding detection rules are set to identify this pattern. The intrusion detection system construction tool (such as Snort or Suricata) is used to configure the rules and strategies to detect and defend these attack patterns. By monitoring and analyzing real-time data, an intrusion detection system that can identify and respond to known vulnerability attack patterns is constructed. Finally, the intrusion detection system data is generated to provide real-time security monitoring and defense capabilities.

[0214] Optionally, the present specification further provides a computer device, which includes a computer device main body, a power supply unit and an electrical control unit, wherein the power supply unit is installed inside the computer device main body, the electrical control unit is electrically connected to the power supply unit, and the electrical control unit is used to charge the computer device main body and control the computer device main body, and the electrical control unit includes:

[0215] Information security model building module: used to obtain computer equipment information data, and extract security policy data based on the computer equipment information data, thereby obtaining security policy data; construct a computer information security topology structure model based on the security policy data, thereby obtaining a computer information security topology structure model;

[0216] Communication risk classification module: used to extract computer communication data according to computer equipment information data, thereby obtaining computer communication data; perform communication risk analysis according to computer communication data, thereby obtaining communication risk data; perform communication risk classification on the computer information security topology structure model according to the communication risk data, thereby obtaining a computer communication risk topology structure model;

[0217] Communication vulnerability detection module: used to obtain computer equipment operation logs, and perform computer energy consumption analysis based on computer equipment operation logs, thereby obtaining computer operation energy consumption data; perform communication vulnerability detection on computer communication data based on the computer communication risk topology model, thereby obtaining computer communication vulnerability data;

[0218] Intrusion detection system construction module: used to perform correlation analysis based on computer operation energy consumption data and computer communication vulnerability data, so as to obtain computer communication vulnerability energy consumption correlation data; construct an intrusion detection system based on computer communication vulnerability energy consumption correlation data, so as to obtain intrusion detection system data;

[0219] Communication security monitoring module: used to perform communication operation security monitoring on computer equipment information data according to the intrusion detection system, so as to obtain communication operation security data and upload it to the computer equipment management cloud platform to perform computer communication security operation tasks.

[0220] A computer device of the present invention can implement any computer operation method of the present invention, and is used to combine the operation and signal transmission medium between various modules to complete a computer operation method. The internal modules of the device cooperate with each other, thereby improving the security of computer communication operation.

[0221] Therefore, the embodiments should be regarded as illustrative and non-restrictive from all points, and the scope of the present invention is limited by the appended claims rather than the above description, and it is therefore intended that all changes falling within the meaning and range of equivalent elements of the application documents are included in the present invention.

[0222] The above description is only a specific embodiment of the present invention, so that those skilled in the art can understand or implement the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but should conform to the widest scope consistent with the principles and novel features invented herein.

Claims

1. A computer device operation method, characterized in that: The following steps are involved: Step S1: Obtain computer device information data, and extract security policy data based on the computer device information data, thereby obtaining security policy data; Constructing a computer information security topology structure model according to security policy data, thereby obtaining a computer information security topology structure model; Step S2: extracting computer communication data according to the computer device information data, thereby obtaining computer communication data; Performing communication risk analysis based on computer communication data to obtain communication risk data; According to the communication risk data, the computer information security topology structure model is divided into communication risks, so as to obtain the computer communication risk topology structure model; Step S3: obtaining computer equipment operation logs, and performing computer energy consumption analysis based on the computer equipment operation logs, thereby obtaining computer operation energy consumption data; performing communication vulnerability detection on computer communication data based on the computer communication risk topology structure model, thereby obtaining computer communication vulnerability data; Step S4: performing correlation analysis based on the computer operation energy consumption data and the computer communication vulnerability data, thereby obtaining computer communication vulnerability energy consumption correlation data; constructing an intrusion detection system based on the computer communication vulnerability energy consumption correlation data, thereby obtaining intrusion detection system data; Step S5: Perform communication operation security monitoring on computer equipment information data according to the intrusion detection system to obtain communication operation security data, and upload it to the computer equipment management cloud platform to execute computer communication security operation tasks.

2. The computer device operation method according to claim 1, characterized in that: Step S1 is specifically as follows: Step S11: acquiring computer device information data, and extracting security policy data according to the computer device information data, thereby obtaining security policy data; Step S12: classifying the security policy hierarchy according to the security policy data, thereby obtaining the network layer security policy and the application layer security policy; Step S13: constructing routing nodes according to the network layer security policy, thereby obtaining routing node data; Step S14: constructing a firewall node according to the application layer security policy, thereby obtaining firewall node data; Step S15: performing computer node spatial fusion according to the routing node data and the firewall node data, thereby obtaining computer node data; Step S16: Performing computer node communication connection on the computer node data according to the security policy data, thereby obtaining computer node communication data; Step S17: constructing a computer information security topology structure model according to the computer node data and the computer node communication data, thereby obtaining a computer information security topology structure model.

3. The computer device operation method according to claim 1, characterized in that: Step S2 is specifically as follows: Step S21: extracting computer communication data according to computer device information data, thereby obtaining computer communication data; Step S22: performing a request service risk analysis based on the computer communication data, thereby obtaining request service risk data; Step S23: performing data leakage risk analysis based on computer communication data to obtain data leakage risk data; Step S24: integrating communication risk data according to the denial of service attack risk data and the data leakage risk data, thereby obtaining communication risk data; Step S25: performing communication risk classification on the computer security topology structure model according to the communication risk data, thereby obtaining a computer communication risk topology structure model.

4. The computer device operation method according to claim 3, characterized in that: Step S22 is specifically as follows: Step S221: extracting communication flow characteristics according to computer communication data, thereby obtaining communication flow data; Step S222: decoding the communication traffic data into packets, thereby obtaining packet decoding data; Step S223: performing handshake behavior statistics of the data packets according to the decoded data of the data packets, thereby obtaining handshake data packets and non-handshake data packets; Step S224: performing data packet transmission frequency statistics according to the data packet decoding data, thereby obtaining high-frequency data packet transmission data and low-frequency data packet transmission data; Step S225: performing a false request service intersection operation according to the high-frequency data packet transmission data and the unhandshake data packet data, thereby obtaining false request service data; Step S226: performing a real request service intersection operation according to the low-frequency data packet transmission data and the handshake data packet data, thereby obtaining real request service data; Step S227: integrating the request service risk according to the false request service data and the real request service data, thereby obtaining the request service risk data.

5. The computer device operation method according to claim 3, characterized in that: Step S23 is specifically as follows: Step S231: extracting transmission data features according to computer communication data, thereby obtaining transmission data; Step S232: performing transmission protocol identification on the transmission data, thereby obtaining data transmission protocol data; Step S233: performing protocol field statistics according to the data transmission protocol data, thereby obtaining abnormal protocol field data; Step S234: performing transmission time statistics according to the transmission data, thereby obtaining abnormal transmission time data; Step S235: performing data leakage intersection operation according to the abnormal protocol field data and the abnormal transmission time data, thereby obtaining data leakage data; Step S236: Perform risk assessment based on the data leakage data to obtain data leakage risk data.

6. The computer device operation method according to claim 1, characterized in that: Step S3 is specifically as follows: Step S31: obtaining a computer device operation log, and performing temperature sensing feature extraction according to the computer device operation log, thereby obtaining temperature sensing data; Step S32: obtaining CPU load data and storing the load data; Step S33: performing CPU energy consumption analysis on the CPU load data according to the temperature sensing data, thereby obtaining CPU energy consumption temperature data; Step S34: performing storage energy consumption analysis on the storage load data according to the temperature sensing data, thereby obtaining storage energy consumption temperature data; Step S35: integrating the computer operation energy consumption data according to the CPU energy consumption temperature data and the storage energy consumption temperature data, thereby obtaining the computer operation energy consumption data; Step S36: Perform communication vulnerability detection on computer communication data according to the computer communication risk topology structure model, thereby obtaining computer communication vulnerability data.

7. The computer device operation method according to claim 6, characterized in that: Step S33 is specifically as follows: Step S331: extracting CPU core load distribution features according to the CPU load data, thereby obtaining CPU core load distribution data; Step S332: Calculate the core load utilization rate and the operating frequency according to the CPU core load distribution data, thereby obtaining the core load utilization rate data and the CPU operating frequency data; Step S333: collecting CPU core load distribution temperature data on the CPU core load distribution data according to the temperature sensing data, thereby obtaining the CPU core load distribution temperature data; Step S334: performing usage statistics according to the core load usage data, thereby obtaining CPU high usage data and CPU low usage data; Step S335: performing operating frequency statistics on the CPU operating frequency data, thereby obtaining CPU high-frequency operating data and CPU low-frequency operating data; Step S336: performing a high energy consumption operation intersection operation on the CPU high usage rate data and the CPU high frequency operation data, thereby obtaining the CPU high energy consumption operation data; Step S337: performing a low energy consumption operation intersection operation according to the CPU low usage rate data and the CPU low frequency operation data, thereby obtaining the CPU low energy consumption operation data; Step S338: integrating the CPU energy consumption relationship according to the CPU high energy consumption operation data and the CPU low energy consumption operation data, thereby obtaining the CPU energy consumption data; Step S339: Perform energy consumption-temperature mapping on the CPU energy consumption data according to the CPU core load distribution temperature data, thereby obtaining the CPU energy consumption-temperature data.

8. The computer device operation method according to claim 6, characterized in that: Step S34 is specifically as follows: Step S341: extracting storage read / write features according to storage load data, thereby obtaining storage read / write data; Step S342: performing I / O operation concurrency calculation according to the stored read / write data, thereby obtaining I / O operation concurrency data; Step S343: performing storage load temperature statistics on the storage load data according to the temperature sensing data, thereby obtaining storage load temperature data; Step S344: performing system performance evaluation on the I / O operation concurrency data to obtain system performance data; Step S345: performing storage energy consumption statistics according to the system performance data, thereby obtaining computer storage energy consumption data; Step S346: temperature mapping the computer storage energy consumption data according to the storage load temperature data, thereby obtaining storage energy consumption temperature data.

9. The computer device operation method according to claim 1, characterized in that: Step S4 is specifically as follows: Step S41: performing time distribution calculation according to the computer operation energy consumption data and the computer communication vulnerability data, thereby obtaining operation energy consumption time distribution data and communication vulnerability time distribution data; Step S42: performing time distribution overlap statistics according to the operation energy consumption time distribution data and the communication vulnerability time distribution data, thereby obtaining time distribution overlap data; Step S43: extracting computer vulnerability features according to the time distribution overlap data, thereby obtaining computer vulnerability data; Step S44: performing vulnerability attack pattern statistics according to the computer vulnerability data, thereby obtaining vulnerability attack pattern data; Step S45: construct an intrusion detection system according to the vulnerability attack pattern data, thereby obtaining intrusion detection system data.

10. A computer device, characterized in that: The computer device comprises a main body, a power supply and an electrical control unit. The power supply is installed inside the main body of the computer device. The electrical control unit is electrically connected to the power supply. The electrical control unit is used to charge the main body of the computer device and control the main body of the computer device. The electrical control unit comprises: Information security model building module: used to obtain computer equipment information data, and extract security policy data based on the computer equipment information data, thereby obtaining security policy data; construct a computer information security topology structure model based on the security policy data, thereby obtaining a computer information security topology structure model; Communication risk classification module: used to extract computer communication data according to computer equipment information data, thereby obtaining computer communication data; perform communication risk analysis according to computer communication data, thereby obtaining communication risk data; perform communication risk classification on the computer information security topology structure model according to the communication risk data, thereby obtaining a computer communication risk topology structure model; Communication vulnerability detection module: used to obtain computer equipment operation logs, and perform computer energy consumption analysis based on computer equipment operation logs, thereby obtaining computer operation energy consumption data; perform communication vulnerability detection on computer communication data based on the computer communication risk topology model, thereby obtaining computer communication vulnerability data; Intrusion detection system construction module: used to perform correlation analysis based on computer operation energy consumption data and computer communication vulnerability data, so as to obtain computer communication vulnerability energy consumption correlation data; construct an intrusion detection system based on computer communication vulnerability energy consumption correlation data, so as to obtain intrusion detection system data; Communication security monitoring module: used to perform communication operation security monitoring on computer equipment information data according to the intrusion detection system, so as to obtain communication operation security data and upload it to the computer equipment management cloud platform to perform computer communication security operation tasks.

Images