Data center security monitoring data management system and method

Abstract

The invention discloses a data center security monitoring data management system and method, and relates to the technical field of data management. The system comprises a script scanning and script data set construction module, a script dependency relationship analysis module, a risk assessment module, a real-time monitoring and dynamic risk assessment module and an early warning information generation module. The script scanning and script data set construction module is responsible for acquiring a script and a data flow path thereof and constructing a script data set; the script dependency relationship analysis module constructs a script dependency relationship graph based on the script data set and evaluates the importance degree of each script; the risk assessment module is used for identifying a particularly concerned node, calculating a risk influence degree and carrying out risk grade division; the real-time monitoring and dynamic risk assessment module is used for acquiring scripts and data flow paths in real time to construct a real-time script dependency graph and performing real-time risk assessment; and the early warning information generation module is used for generating and outputting early warning information.

Description

Technical Field

[0001] The present invention relates to the technical field of data analysis, and in particular to a data center security monitoring data management system and method. Background Art

[0002] With the rapid development of information technology and the widespread use of data centers, scripts are becoming increasingly important in automated tasks and system management. However, the execution of scripts also brings potential security risks, especially in large-scale and complex IT environments. Malicious script injection, misoperation or improper configuration may lead to data leakage, service interruption or even system paralysis. Therefore, it is particularly important to build an effective security monitoring data management system to identify and deal with these potential script security risks.

[0003] Existing data center security monitoring methods mostly use static analysis methods, focusing mainly on network security and hardware facility security. These methods are effective in identifying potential threats, but they often fail to fully cover the dynamic changes in data flow, making it difficult to timely discover and handle abnormal situations and potential risks during script execution. In addition, traditional methods lack systematicity in evaluating dependencies between scripts, input and output data flows, and key nodes, and cannot effectively identify key influencing factors and potential risks in the data flow process. Summary of the invention

[0004] The object of the present invention is to provide a data center security monitoring data management system and method to solve the problems raised in the above background technology.

[0005] In order to solve the above technical problems, the present invention provides the following technical solutions: A data center security monitoring data management method comprises the following steps: Step S100. Obtain all scripts and their data flow paths in the data center, assign a unique identifier to each script, summarize all scripts and their data flow paths based on the identifier, and draw a corresponding data flow diagram; organize the data flow diagram to form a script data set; Step S200. Extract the input and output information of each script according to the data flow diagram in the script data set; construct a script dependency graph according to the input and output information of the script; and evaluate the importance of each script in the script dependency graph based on the script dependency graph; Step S300. According to the evaluation result of the importance of each script in the script dependency graph, identify and mark the nodes of special concern; based on the script dependency graph, analyze the impact on the overall data flow when the nodes of special concern fail, so as to conduct risk assessment on all other nodes in the script dependency graph except the nodes of special concern, and classify all scripts into risk levels; Step S400. At every selected time period, all scripts and their data flow paths in the data center are obtained in real time, and a real-time script dependency graph is constructed; based on the real-time script dependency graph, real-time special attention nodes are identified, and all scripts in the data center are classified into risk levels, and corresponding notification information is generated according to the risk level classification results.

[0006] Furthermore, step S100 includes: S101. Use an automated tool to scan the data center, identify all script information of the data center, and form a script set S, where S={s1,s2,...,sn}, where s1 represents the first script information of the data center, s2 represents the second script information of the data center, and so on, sn represents the nth script information of the data center; for each script si in each script set, capture the corresponding input and output paths, so as to construct the data flow path of each script, and represent it as a data flow path set P, and Pi={p1,p2,...,pm}i, where p1 represents the first data flow path of the i-th script, p2 represents the second data flow path of the i-th script, and so on, pm represents the m-th data flow path of the i-th script; S102. Assign a unique identifier ID to each script si, and i is a positive integer between 1 and n; and mark the corresponding data flow path set P according to the identifier corresponding to the script, expressed as P(ID); summarize all scripts and their data flow paths based on the identifier, and use the graph theory model to represent each script and its data flow path as a directed graph, thereby obtaining the corresponding data flow graph D=(V,E), where V represents a node set, and the node set V represents all data nodes of the corresponding script; E represents an edge set, and the edge set E represents all data flow paths of the corresponding script; according to the identifier corresponding to the script The script data set SD is constructed by matching each script with the corresponding data flow graph according to the identifier ID, and SD={[ID(s1),D1],[ID(s2),D2],...,[ID(sn),Dn]}, where [ID(s1),D1] represents the data set consisting of the identifier and data flow graph corresponding to the first script in the data center, [ID(s2),D2] represents the data set consisting of the identifier and data flow graph corresponding to the second script in the data center, and so on, [ID(sn),Dn] represents the data set consisting of the identifier and data flow graph corresponding to the nth script in the data center.

[0007] Further, step S200 includes: S201. According to the data flow graph in the script data set, for each script si, extract the input and output information from the corresponding data flow graph Dj, specifically including: for input information, identify all data inflow paths related to the script si from the data flow graph Dj of the script si, and record the nodes of these data inflow paths, so as to obtain the input node set Ii of the script si; for output information, identify all data outflow paths related to the script si from the data flow graph Di of the script si, and record the nodes of these data outflow paths, so as to obtain the output node set Oi of the script si; S202. The input and output information of each script is used to construct a script dependency graph R=(S0,F), where S represents a node set, and the node set is represented by a script set S, and each node in the node set represents a script; F represents an edge set, which represents the dependency relationship between different scripts; S203. Based on the script dependency graph, calculate the indegree and outdegree of each script. The specific formula is as follows: indegree(si)=|sm|(sm,si)∈F|, where sm represents the script that depends on script si; outdegree(si)=|sl|(si,sl)∈F|, where sl represents the script that script si depends on; According to the indegree indegree and outdegree outdegree, the script's influence Im is calculated comprehensively. The specific calculation formula is: Im(si)=w1×indegree(si)+w2×outdegree(si), where w1 and w2 represent weight coefficients, and w1+w2=1; The betweenness centrality CB of each script is calculated, and the betweenness centrality is used to measure the degree to which the script acts as an intermediary in the dependency graph, indicating the frequency with which a script acts as an intermediary in the data flow process; the specific calculation formula is: CB(si)=∑sm≠sl≠si,σ(sm,sl|si) / σ(sm,sl), Among them, σ(sm,sl) represents the number of shortest paths between scripts sm and sl, and σ(sm,sl|si) represents the number of shortest paths containing script si. Combining in-degree, out-degree and betweenness centrality, the importance of each script in the script dependency graph is comprehensively evaluated to obtain the importance index Z. The specific calculation formula is: Z(si)=a×Im(si)+b×CB(si), where a and b represent impact factors.

[0008] Furthermore, the determination of dependency relationships between different scripts includes input-output relationship determination and reverse dependency relationship determination, specifically including: For input-output relationship judgment, if the output node set Oi of script si intersects with the input node set Ij of script sj, it means that script sj depends on script si, and an edge (si, sj) is added to the dependency graph, where j is a positive integer between 1 and n, and i≠j; For reverse dependency determination, if the output node set Oj of script sj intersects with the input node set Ii of script si, it means that script si depends on script sj, and script si must wait for script sj to be executed before it can perform its own operations; Combining the above two judgment conditions, the construction rule of the edge set F in the dependency graph is: F={(si,sj)|Oi∩Ij≠0 or Oj∩Ii≠0, 1≤i,j≤n}.

[0009] Although both types of dependencies describe the relationship between scripts, their meanings and impacts are different. Specifically: Forward dependency (input-output relationship determination): emphasizes that the output of a script is a prerequisite for the execution of another script. This dependency usually indicates the direction of data flow and is a common data transfer dependency; Reverse dependency (reverse dependency determination): emphasizes that a script needs to wait for another script to be executed before it can continue to execute; it focuses more on the dependency of execution timing, that is, the script executed first (reverse dependency) will affect the start time of the script executed later. This relationship is more reflected in scheduling and control flow.

[0010] Furthermore, step S300 includes: S301. Obtain the importance index of all scripts in the script dependency graph, calculate the corresponding average value Zμ and standard deviation Zσ, calculate the corresponding importance index threshold Z0, and Z0=Zμ+k×Zσ, where k represents the coefficient; if there is a script si whose importance index Z(si)≥importance index threshold Z0, then mark the script si as a special attention node sf in the script dependency graph; summarize all the special attention nodes in the script dependency graph to form a special attention node set F; S302. Based on the script dependency graph, assuming that a failure occurs in the special attention node sf, calculate the degree of impact of the failure of the special attention node sf on each other script sj in the script dependency graph I(sf,sj), and the specific calculation formula is: I(sf,sj)=1 / [1+d(sf,sj)], Where d(si,sj) represents the shortest path length from the special attention node sf to the script sj; for each script sj, the total degree of influence I(sj) is calculated, and I(sj)=∑sf∈F,I(sf,sj); S303. According to the total impact value I(sj) corresponding to each script sj and the corresponding importance index Z(sj), the corresponding overall risk index P(sj) is calculated, and the calculation formula is: P(sj)=λ×I(sj)+(1-λ)×Z(sj), Where λ represents the weight coefficient; for the special attention node, the corresponding overall risk index P(sf) is calculated, and the specific calculation formula is: P(sj)=λ×N(f)+(1-λ)×Z(sj), Where N(f) represents the number of special attention nodes in the special attention node set F; S304. Summarize the overall risk index P corresponding to all scripts, and divide all scripts into several risk levels U according to the size of the overall risk index. The specific risk level division process is as follows: Assume that the number of risk levels U is M, and the risk levels are numbered as: U1, U2, ..., UM, where U1 has the lowest risk level and UM has the highest risk level; Arrange the overall risk index P corresponding to all scripts in order from large to small, so as to extract the maximum value P_max and the minimum value P_min in the overall risk index; based on the maximum value P_max and the minimum value P_min in the overall risk index, calculate the corresponding span value △P for dividing the risk level, and △P=(P_max-P_min) / M; according to the span value △P, calculate the interval range Q of each risk level, and the minimum value Q1_min=P_min and the maximum value Q1_max=P_min+△P corresponding to the interval range Q1 of the first risk level; the minimum value Q2_min=P_min+△P and the maximum value Q2_max=P_min+2△P corresponding to the interval range Q2 of the second risk level; and so on, the minimum value QM_min=P_min+(M-1)△P and the maximum value QM_max=P_max corresponding to the interval range QM of the Mth risk level.

[0011] Furthermore, step S400 includes: S401. At every selected time period T, all scripts and their data flow paths in the data center are obtained in real time. According to the analysis process from step S100 to step S300, a real-time script data set SD', a real-time script dependency graph G' and real-time special attention nodes are constructed, and the risk levels of all scripts in the current data center are obtained, and the real-time special attention nodes are stored; the identifiers of all scripts in the current data center are extracted from the real-time script data set SD'. If there are new scripts, the risk level U' of the new scripts is calculated according to the real-time script dependency graph G' and the real-time special attention nodes, and a risk level list of the new scripts is generated for relevant personnel; S402. For other scripts, extract the risk level U corresponding to the previous selected time period T and compare it with the current risk level U'. If the risk level U is less than the risk level U', it means that the risk level of the current script has increased, and generate a warning message to output to relevant personnel, where the warning message includes the corresponding script identifier; if the risk level U is greater than or equal to the risk level U', it means that the risk level of the current script has decreased or remains unchanged, and no warning message is generated.

[0012] A data center security monitoring data management system, comprising: a script scanning and script data set building module, a script dependency analysis module, a risk assessment module, a real-time monitoring and dynamic risk assessment module, and an early warning information generation module; The script scanning and script data set construction module obtains all scripts and their data flow paths in the data center, assigns a unique identifier to each script, draws data flow diagrams based on these identifiers, organizes the data flow diagrams, and forms a script data set with the scripts and their data flow diagrams; The script dependency analysis module extracts the input and output information of each script according to the data flow diagram in the script data set, and constructs a dependency diagram between scripts; based on the script dependency diagram, it calculates the in-degree, out-degree, and betweenness centrality of each script, and comprehensively evaluates the importance of each script in the script dependency diagram; The risk assessment module identifies and marks nodes of special concern based on the results of the script importance assessment; analyzes the impact of failures in nodes of special concern on other scripts, conducts risk assessment on all scripts, and divides the scripts into several risk levels based on the overall risk index; The real-time monitoring and dynamic risk assessment module obtains all scripts and their data flow paths in the data center in real time, identifies nodes of special concern in real time based on the data obtained in real time, and conducts risk assessment on all current scripts to obtain the risk level of all current scripts; The warning information generation module generates corresponding warning information according to the results of risk assessment and real-time monitoring, and stores the real-time risk levels of the nodes of special concern and the newly added scripts.

[0013] Further, the script scanning and script data set construction module includes a script scanning unit, a data flow path identification unit and a data flow graph construction unit; The script scanning unit scans all scripts in the data center, identifies and collects information about each script, and generates a script set and a data flow path set; the data flow path identification unit is used to identify the data flow path of each script; the data flow graph construction unit draws a data flow graph based on the script and its data flow path, and corresponds each script to the corresponding data flow graph to form a script data set; The script dependency analysis module includes an input and output information extraction unit, a script dependency graph construction unit, and an importance assessment unit; The input-output information extraction unit extracts the input information and output information of each script from the data flow graph and identifies all input nodes and output nodes; the script dependency graph construction unit constructs the dependency graph between scripts based on the extracted input and output information; the importance evaluation unit calculates the in-degree, out-degree, and betweenness centrality of each script, and comprehensively evaluates the importance of each script in the dependency graph to obtain an importance index.

[0014] Further, the risk assessment module includes a special concern node identification unit, an impact degree calculation unit, and an overall risk assessment unit; The special attention node identification unit identifies and marks the special attention nodes based on the script dependency graph and importance assessment results; the impact calculation unit calculates the impact of the special attention node failure on other scripts, and calculates the total impact value of each script; the overall risk assessment unit calculates the overall risk index of each script based on the special attention nodes and the impact, and divides all scripts into risk levels according to the overall risk index.

[0015] Further, the real-time monitoring and dynamic risk assessment module includes a real-time data acquisition unit, a real-time special attention node identification unit, and a real-time risk assessment unit; The real-time data collection unit periodically obtains all scripts and their data flow paths in the data center, and builds a real-time script data set and script dependency graph; the real-time special attention node identification unit identifies the special attention nodes in the current data flow graph based on real-time data; the real-time risk assessment unit assesses the risk level of all current scripts based on the real-time script data set and dependency graph; The early warning information generation module includes a new script risk assessment unit, a risk level change monitoring unit, and an early warning information generation unit; The newly added script risk assessment unit calculates the risk level of the newly added script and generates a corresponding risk assessment list; the risk level change monitoring unit monitors the risk level change of the script to determine whether the current risk level has increased, and generates warning information if it has increased; the warning information generation unit generates warning information based on the risk assessment results of the risk level change monitoring unit and pushes it to relevant personnel.

[0016] Compared with the prior art, the beneficial effects of the present invention are as follows: the present invention can identify the input and output information of each script and its dependencies in detail by comprehensively scanning and summarizing all scripts and their data flow paths in the data center, and form a clear data flow diagram and script dependency diagram; this comprehensive and systematic monitoring method helps to timely discover potential risks and reduce the probability of data leakage or system failure. The present invention comprehensively evaluates the importance and influence of each script in the dependency diagram based on multiple parameters such as in-degree, out-degree, and betweenness centrality; in addition, by calculating the overall risk index of each script, it can effectively identify key scripts that need special attention, and evaluate their risk levels according to their impact on the overall system; this comprehensive evaluation method enables the data center to monitor risks at a finer granularity, thereby improving security. By combining the risk index of the script with the selected risk level classification rules, the present invention can classify all scripts into multiple risk levels to form a detailed risk level management system; this quantitative risk level classification enables managers to clearly understand the security status of each script, helps to prioritize high-risk scripts, and improve the overall security of the data center. The real-time monitoring function of the present invention enables the data center to dynamically evaluate the risk level of each script based on the real-time data flow and script status, and to mark the nodes of special concern in real time; if the risk level of any script is found to be elevated, the system can generate early warning information in a timely manner to notify relevant personnel to take measures; this real-time risk assessment and early warning mechanism can effectively prevent the occurrence of security incidents and ensure the stability of the system. The present invention can monitor the addition or modification of scripts in real time, and quickly evaluate its impact on the overall system security based on the dependency and risk index of the newly added scripts; this mechanism ensures that the data center will not cause potential security risks due to lack of adaptability when facing script updates. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings: Figure 1 It is a schematic diagram of a data center security monitoring data management system module of the present invention. DETAILED DESCRIPTION

[0018] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0019] See also Figure 1 , the present invention provides a technical solution: A data center security monitoring data management system, comprising: a script scanning and script data set building module, a script dependency analysis module, a risk assessment module, a real-time monitoring and dynamic risk assessment module, and an early warning information generation module; The script scanning and script data set construction module obtains all scripts and their data flow paths in the data center, assigns a unique identifier to each script, draws data flow diagrams based on these identifiers, organizes the data flow diagrams, and forms a script data set with the scripts and their data flow diagrams; The script dependency analysis module extracts the input and output information of each script according to the data flow diagram in the script data set, and constructs a dependency diagram between scripts; based on the script dependency diagram, it calculates the in-degree, out-degree, and betweenness centrality of each script, and comprehensively evaluates the importance of each script in the script dependency diagram; The risk assessment module identifies and marks nodes of special concern based on the results of the script importance assessment; analyzes the impact of failures in nodes of special concern on other scripts, conducts risk assessment on all scripts, and divides the scripts into several risk levels based on the overall risk index; The real-time monitoring and dynamic risk assessment module obtains all scripts and their data flow paths in the data center in real time, identifies nodes of special concern in real time based on the data obtained in real time, and conducts risk assessment on all current scripts to obtain the risk level of all current scripts; The warning information generation module generates corresponding warning information according to the results of risk assessment and real-time monitoring, and stores the real-time risk levels of the nodes of special concern and the newly added scripts.

[0020] The script scanning and script data set construction module includes a script scanning unit, a data flow path identification unit and a data flow graph construction unit; The script scanning unit scans all scripts in the data center, identifies and collects information about each script, and generates a script set and a data flow path set; the data flow path identification unit is used to identify the data flow path of each script; the data flow graph construction unit draws a data flow graph based on the script and its data flow path, and corresponds each script to the corresponding data flow graph to form a script data set; The script dependency analysis module includes an input and output information extraction unit, a script dependency graph construction unit, and an importance assessment unit; The input-output information extraction unit extracts the input information and output information of each script from the data flow graph and identifies all input nodes and output nodes; the script dependency graph construction unit constructs the dependency graph between scripts based on the extracted input and output information; the importance evaluation unit calculates the in-degree, out-degree, and betweenness centrality of each script, and comprehensively evaluates the importance of each script in the dependency graph to obtain an importance index.

[0021] The risk assessment module includes a special concern node identification unit, an impact calculation unit, and an overall risk assessment unit; The special attention node identification unit identifies and marks the special attention nodes based on the script dependency graph and importance assessment results; the impact calculation unit calculates the impact of the special attention node failure on other scripts, and calculates the total impact value of each script; the overall risk assessment unit calculates the overall risk index of each script based on the special attention nodes and the impact, and divides all scripts into risk levels according to the overall risk index.

[0022] The real-time monitoring and dynamic risk assessment module includes a real-time data acquisition unit, a real-time special attention node identification unit, and a real-time risk assessment unit; The real-time data collection unit periodically obtains all scripts and their data flow paths in the data center, and builds a real-time script data set and script dependency graph; the real-time special attention node identification unit identifies the special attention nodes in the current data flow graph based on real-time data; the real-time risk assessment unit assesses the risk level of all current scripts based on the real-time script data set and dependency graph; The early warning information generation module includes a new script risk assessment unit, a risk level change monitoring unit, and an early warning information generation unit; The newly added script risk assessment unit calculates the risk level of the newly added script and generates a corresponding risk assessment list; the risk level change monitoring unit monitors the risk level change of the script to determine whether the current risk level has increased, and generates warning information if it has increased; the warning information generation unit generates warning information based on the risk assessment results of the risk level change monitoring unit and pushes it to relevant personnel.

[0023] A data center security monitoring data management method comprises the following steps: Step S100. Obtain all scripts and their data flow paths in the data center, assign a unique identifier to each script, summarize all scripts and their data flow paths based on the identifier, and draw a corresponding data flow diagram; organize the data flow diagram to form a script data set; Step S200. Extract the input and output information of each script according to the data flow diagram in the script data set; construct a script dependency graph according to the input and output information of the script; and evaluate the importance of each script in the script dependency graph based on the script dependency graph; Step S300. According to the evaluation result of the importance of each script in the script dependency graph, identify and mark the nodes of special concern; based on the script dependency graph, analyze the impact on the overall data flow when the nodes of special concern fail, so as to conduct risk assessment on all other nodes in the script dependency graph except the nodes of special concern, and classify all scripts into risk levels; Step S400. At every selected time period, all scripts and their data flow paths in the data center are obtained in real time, and a real-time script dependency graph is constructed; based on the real-time script dependency graph, real-time special attention nodes are identified, and all scripts in the data center are classified into risk levels, and corresponding notification information is generated according to the risk level classification results.

[0024] Step S100 includes: S101. Use an automated tool to scan the data center, identify all script information of the data center, and form a script set S, where S={s1,s2,...,sn}, where s1 represents the first script information of the data center, s2 represents the second script information of the data center, and so on, sn represents the nth script information of the data center; for each script si in each script set, capture the corresponding input and output paths, so as to construct the data flow path of each script, and represent it as a data flow path set P, and Pi={p1,p2,...,pm}i, where p1 represents the first data flow path of the i-th script, p2 represents the second data flow path of the i-th script, and so on, pm represents the m-th data flow path of the i-th script; S102. Assign a unique identifier ID to each script si, and i is a positive integer between 1 and n; and mark the corresponding data flow path set P according to the identifier corresponding to the script, expressed as P(ID); summarize all scripts and their data flow paths based on the identifier, and use the graph theory model to represent each script and its data flow path as a directed graph, thereby obtaining the corresponding data flow graph D=(V,E), where V represents a node set, and the node set V represents all data nodes of the corresponding script; E represents an edge set, and the edge set E represents all data flow paths of the corresponding script; according to the identifier corresponding to the script The script data set SD is constructed by matching each script with the corresponding data flow graph according to the identifier ID, and SD={[ID(s1),D1],[ID(s2),D2],...,[ID(sn),Dn]}, where [ID(s1),D1] represents the data set consisting of the identifier and data flow graph corresponding to the first script in the data center, [ID(s2),D2] represents the data set consisting of the identifier and data flow graph corresponding to the second script in the data center, and so on, [ID(sn),Dn] represents the data set consisting of the identifier and data flow graph corresponding to the nth script in the data center.

[0025] Step S200 includes: S201. According to the data flow graph in the script data set, for each script si, extract the input and output information from the corresponding data flow graph Dj, specifically including: for input information, identify all data inflow paths related to the script si from the data flow graph Dj of the script si, and record the nodes of these data inflow paths, so as to obtain the input node set Ii of the script si; for output information, identify all data outflow paths related to the script si from the data flow graph Di of the script si, and record the nodes of these data outflow paths, so as to obtain the output node set Oi of the script si; S202. The input and output information of each script is used to construct a script dependency graph R=(S0,F), where S represents a node set, and the node set is represented by a script set S, and each node in the node set represents a script; F represents an edge set, which represents the dependency relationship between different scripts; S203. Based on the script dependency graph, calculate the indegree and outdegree of each script. The specific formula is as follows: indegree(si)=|sm|(sm,si)∈F|, where sm represents the script that depends on script si; outdegree(si)=|sl|(si,sl)∈F|, where sl represents the script that script si depends on; According to the indegree indegree and outdegree outdegree, the script's influence Im is calculated comprehensively. The specific calculation formula is: Im(si)=w1×indegree(si)+w2×outdegree(si), where w1 and w2 represent weight coefficients, and w1+w2=1; The betweenness centrality CB of each script is calculated, and the betweenness centrality is used to measure the degree to which the script acts as an intermediary in the dependency graph, indicating the frequency with which a script acts as an intermediary in the data flow process; the specific calculation formula is: CB(si)=∑sm≠sl≠si,σ(sm,sl|si) / σ(sm,sl), Among them, σ(sm,sl) represents the number of shortest paths between scripts sm and sl, and σ(sm,sl|si) represents the number of shortest paths containing script si. Combining in-degree, out-degree and betweenness centrality, the importance of each script in the script dependency graph is comprehensively evaluated to obtain the importance index Z. The specific calculation formula is: Z(si)=a×Im(si)+b×CB(si), where a and b represent impact factors.

[0026] The determination of dependency relationships between different scripts includes input-output relationship determination and reverse dependency relationship determination, specifically including: For input-output relationship judgment, if the output node set Oi of script si intersects with the input node set Ij of script sj, it means that script sj depends on script si, and an edge (si, sj) is added to the dependency graph, where j is a positive integer between 1 and n, and i≠j; For reverse dependency determination, if the output node set Oj of script sj intersects with the input node set Ii of script si, it means that script si depends on script sj, and script si must wait for script sj to be executed before it can perform its own operations; Combining the above two judgment conditions, the construction rule of the edge set F in the dependency graph is: F={(si,sj)|Oi∩Ij≠0 or Oj∩Ii≠0, 1≤i,j≤n}.

[0027] Although both types of dependencies describe the relationship between scripts, their meanings and impacts are different. Specifically: Forward dependency (input-output relationship determination): emphasizes that the output of a script is a prerequisite for the execution of another script. This dependency usually indicates the direction of data flow and is a common data transfer dependency; Reverse dependency (reverse dependency determination): emphasizes that a script needs to wait for another script to be executed before it can continue to execute; it focuses more on the dependency of execution timing, that is, the script executed first (reverse dependency) will affect the start time of the script executed later. This relationship is more reflected in scheduling and control flow.

[0028] Step S300 includes: S301. Obtain the importance index of all scripts in the script dependency graph, calculate the corresponding average value Zμ and standard deviation Zσ, calculate the corresponding importance index threshold Z0, and Z0=Zμ+k×Zσ, where k represents the coefficient; if there is a script si whose importance index Z(si)≥importance index threshold Z0, then mark the script si as a special attention node sf in the script dependency graph; summarize all the special attention nodes in the script dependency graph to form a special attention node set F; S302. Based on the script dependency graph, assuming that a failure occurs in the special attention node sf, calculate the degree of impact of the failure of the special attention node sf on each other script sj in the script dependency graph I(sf,sj), and the specific calculation formula is: I(sf,sj)=1 / [1+d(sf,sj)], Where d(si,sj) represents the shortest path length from the special attention node sf to the script sj; for each script sj, the total degree of influence I(sj) is calculated, and I(sj)=∑sf∈F,I(sf,sj); S303. According to the total impact value I(sj) corresponding to each script sj and the corresponding importance index Z(sj), the corresponding overall risk index P(sj) is calculated, and the calculation formula is: P(sj)=λ×I(sj)+(1-λ)×Z(sj), Where λ represents the weight coefficient; for the special attention node, the corresponding overall risk index P(sf) is calculated, and the specific calculation formula is: P(sj)=λ×N(f)+(1-λ)×Z(sj), Where N(f) represents the number of special attention nodes in the special attention node set F; S304. Summarize the overall risk index P corresponding to all scripts, and divide all scripts into several risk levels U according to the size of the overall risk index. The specific risk level division process is as follows: Assume that the number of risk levels U is M, and the risk levels are numbered as: U1, U2, ..., UM, where U1 has the lowest risk level and UM has the highest risk level; Arrange the overall risk index P corresponding to all scripts in order from large to small, so as to extract the maximum value P_max and the minimum value P_min in the overall risk index; based on the maximum value P_max and the minimum value P_min in the overall risk index, calculate the corresponding span value △P for dividing the risk level, and △P=(P_max-P_min) / M; according to the span value △P, calculate the interval range Q of each risk level, and the minimum value Q1_min=P_min and the maximum value Q1_max=P_min+△P corresponding to the interval range Q1 of the first risk level; the minimum value Q2_min=P_min+△P and the maximum value Q2_max=P_min+2△P corresponding to the interval range Q2 of the second risk level; and so on, the minimum value QM_min=P_min+(M-1)△P and the maximum value QM_max=P_max corresponding to the interval range QM of the Mth risk level.

[0029] In this embodiment, it is assumed that the overall risk index of the scripts in the data center is arranged in order from large to small, and the corresponding maximum value P_max and minimum value P_min are obtained, where P_max=15, P_min=5, and M=4, and the corresponding span value △P for dividing the risk level is calculated, and △P=(P_max-P_min) / M=2.5; then the interval range Q1 corresponding to the risk level U1 is Q1=[5,7.5), the interval range Q2 corresponding to the risk level U2 is Q2=[7.5,10), the interval range Q3 corresponding to the risk level U3 is Q3=[10,12.5), and the interval range Q4 corresponding to the risk level U4 is Q4=[12.5,15].

[0030] Step S400 includes: S401. At every selected time period T, all scripts and their data flow paths in the data center are obtained in real time. According to the analysis process from step S100 to step S300, a real-time script data set SD', a real-time script dependency graph G' and real-time special attention nodes are constructed, and the risk levels of all scripts in the current data center are obtained, and the real-time special attention nodes are stored; the identifiers of all scripts in the current data center are extracted from the real-time script data set SD'. If there are new scripts, the risk level U' of the new scripts is calculated according to the real-time script dependency graph G' and the real-time special attention nodes, and a risk level list of the new scripts is generated for relevant personnel; S402. For other scripts, extract the risk level U corresponding to the previous selected time period T and compare it with the current risk level U'. If the risk level U is less than the risk level U', it means that the risk level of the current script has increased, and generate a warning message to output to relevant personnel, where the warning message includes the corresponding script identifier; if the risk level U is greater than or equal to the risk level U', it means that the risk level of the current script has decreased or remains unchanged, and no warning message is generated.

[0031] In this embodiment, it is assumed that the script risk level in time period T1 (the previous time period) is: Script A: UA=4; Script B: UB=1; Script C: UC=3; Script risk level for time period T2 (current time period): Script A: UA'=2; Script B: UB'=4; Script C: UC'=3; Added script D: UD'=2; For script A: The risk level of the previous time period: UA=4; the risk level of the current time period: UA'=2; since UA>UA', it means that the risk level of the current script is reduced, and no warning information is generated; For script B: The risk level of the previous time period: UB = 1; the risk level of the current time period: UB' = 4; since UB < UB', the risk level of the current script increases, and an early warning message is generated and output to relevant personnel; For script C: The risk level of the previous time period: UC = 3; the risk level of the current time period: UC' = 3; since UB = UB', the risk level of the current script remains unchanged, and no warning information is generated; For the newly added script D, a risk level list of the newly added script is generated for relevant personnel based on the risk level of the current time period: UD'=2.

[0032] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0033] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A data center security monitoring data management method, characterized in that: The method comprises the following steps: Step S100. Obtain all scripts and their data flow paths in the data center, assign a unique identifier to each script, summarize all scripts and their data flow paths based on the identifier, and draw a corresponding data flow diagram; organize the data flow diagram to form a script data set; Step S200. Extract the input and output information of each script according to the data flow diagram in the script data set; construct a script dependency graph according to the input and output information of the script; and evaluate the importance of each script in the script dependency graph based on the script dependency graph; Step S300. According to the evaluation result of the importance of each script in the script dependency graph, identify and mark the nodes of special concern; based on the script dependency graph, analyze the impact on the overall data flow when the nodes of special concern fail, so as to conduct risk assessment on all other nodes in the script dependency graph except the nodes of special concern, and classify all scripts into risk levels; Step S400. At every selected time period, all scripts and their data flow paths in the data center are obtained in real time, and a real-time script dependency graph is constructed; based on the real-time script dependency graph, real-time special attention nodes are identified, and all scripts in the data center are classified into risk levels, and corresponding notification information is generated according to the risk level classification results.

2. A data center security monitoring data management method according to claim 1, characterized in that: The step S100 includes: S101. Use an automated tool to scan the data center, identify all script information of the data center, and form a script set S, where S={s1,s2,...,sn}, where s1 represents the first script information of the data center, s2 represents the second script information of the data center, and so on, sn represents the nth script information of the data center; for each script si in each script set, capture the corresponding input and output paths, so as to construct the data flow path of each script, and represent it as a data flow path set P, and Pi={p1,p2,...,pm}i, where p1 represents the first data flow path of the i-th script, p2 represents the second data flow path of the i-th script, and so on, pm represents the m-th data flow path of the i-th script; S102. Assign a unique identifier ID to each script si, and i is a positive integer between 1 and n; and mark the corresponding data flow path set P according to the identifier corresponding to the script, expressed as P(ID); summarize all scripts and their data flow paths based on the identifier, and use the graph theory model to represent each script and its data flow path as a directed graph, thereby obtaining the corresponding data flow graph D=(V,E), where V represents a node set, and the node set V represents all data nodes of the corresponding script; E represents an edge set, and the edge set E represents all data flow paths of the corresponding script; according to the identifier corresponding to the script The script data set SD is constructed by matching each script with the corresponding data flow graph according to the identifier ID, and SD={[ID(s1),D1],[ID(s2),D2],...,[ID(sn),Dn]}, where [ID(s1),D1] represents the data set consisting of the identifier and data flow graph corresponding to the first script in the data center, [ID(s2),D2] represents the data set consisting of the identifier and data flow graph corresponding to the second script in the data center, and so on, [ID(sn),Dn] represents the data set consisting of the identifier and data flow graph corresponding to the nth script in the data center.

3. A data center security monitoring data management method according to claim 2, characterized in that: The step S200 includes: S201. According to the data flow graph in the script data set, for each script si, extract the input and output information from the corresponding data flow graph Dj, specifically including: for input information, identify all data inflow paths related to the script si from the data flow graph Dj of the script si, and record the nodes of these data inflow paths, so as to obtain the input node set Ii of the script si; for output information, identify all data outflow paths related to the script si from the data flow graph Di of the script si, and record the nodes of these data outflow paths, so as to obtain the output node set Oi of the script si; S202. The input and output information of each script is used to construct a script dependency graph R=(S0,F), where S represents a node set, and the node set is represented by a script set S, and each node in the node set represents a script; F represents an edge set, which represents the dependency relationship between different scripts; S203. Based on the script dependency graph, calculate the indegree and outdegree of each script. The specific formula is as follows: indegree(si)=|sm|(sm,si)∈F|, where sm represents the script that depends on script si; outdegree(si)=|sl|(si,sl)∈F|, where sl represents the script that script si depends on; According to the indegree indegree and outdegree outdegree, the script's influence Im is calculated comprehensively. The specific calculation formula is: Im(si)=w1×indegree(si)+w2×outdegree(si), where w1 and w2 represent weight coefficients, and w1+w2=1; The betweenness centrality CB of each script is calculated, and the betweenness centrality is used to measure the degree to which the script acts as an intermediary in the dependency graph, indicating the frequency with which a script acts as an intermediary in the data flow process; the specific calculation formula is: CB(si)=∑sm≠sl≠si,σ(sm,sl|si) / σ(sm,sl), Among them, σ(sm,sl) represents the number of shortest paths between scripts sm and sl, and σ(sm,sl|si) represents the number of shortest paths containing script si. Combining in-degree, out-degree and betweenness centrality, the importance of each script in the script dependency graph is comprehensively evaluated to obtain the importance index Z. The specific calculation formula is: Z(si)=a×Im(si)+b×CB(si), where a and b represent impact factors.

4. A data center security monitoring data management method according to claim 3, characterized in that: The determination of the dependency relationship between the different scripts includes input-output relationship determination and reverse dependency relationship determination, specifically including: For input-output relationship judgment, if the output node set Oi of script si intersects with the input node set Ij of script sj, it means that script sj depends on script si, and an edge (si, sj) is added to the dependency graph, where j is a positive integer between 1 and n, and i≠j; For reverse dependency determination, if the output node set Oj of script sj intersects with the input node set Ii of script si, it means that script si depends on script sj, and script si must wait for script sj to be executed before it can perform its own operations; Combining the above two judgment conditions, the construction rule of the edge set F in the dependency graph is: F={(si,sj)|Oi∩Ij≠0 or Oj∩Ii≠0, 1≤i,j≤n}.

5. A data center security monitoring data management method according to claim 3, characterized in that: The step S300 includes: S301. Obtain the importance index of all scripts in the script dependency graph, calculate the corresponding average value Zμ and standard deviation Zσ, calculate the corresponding importance index threshold Z0, and Z0=Zμ+k×Zσ, where k represents the coefficient; if there is a script si whose importance index Z(si)≥importance index threshold Z0, then mark the script si as a special attention node sf in the script dependency graph; summarize all the special attention nodes in the script dependency graph to form a special attention node set F; S302. Based on the script dependency graph, assuming that a failure occurs in the special attention node sf, calculate the degree of impact of the failure of the special attention node sf on each other script sj in the script dependency graph I(sf,sj), and the specific calculation formula is: I(sf,sj)=1 / [1+d(sf,sj)], Where d(si,sj) represents the shortest path length from the special attention node sf to the script sj; for each script sj, the total degree of influence I(sj) is calculated, and I(sj)=∑sf∈F,I(sf,sj); S303. According to the total impact value I(sj) corresponding to each script sj and the corresponding importance index Z(sj), the corresponding overall risk index P(sj) is calculated, and the calculation formula is: P(sj)=λ×I(sj)+(1-λ)×Z(sj), Where λ represents the weight coefficient; for the special attention node, the corresponding overall risk index P(sf) is calculated, and the specific calculation formula is: P(sj)=λ×N(f)+(1-λ)×Z(sj), Where N(f) represents the number of special attention nodes in the special attention node set F; S304. Summarize the overall risk index P corresponding to all scripts, and divide all scripts into several risk levels U according to the size of the overall risk index. The specific risk level division process is as follows: Assume that the number of risk levels U is M, and the risk levels are numbered as: U1, U2, ..., UM, where U1 has the lowest risk level and UM has the highest risk level; Arrange the overall risk index P corresponding to all scripts in order from large to small, so as to extract the maximum value P_max and the minimum value P_min in the overall risk index; based on the maximum value P_max and the minimum value P_min in the overall risk index, calculate the corresponding span value △P for dividing the risk level, and △P=(P_max-P_min) / M; according to the span value △P, calculate the interval range Q of each risk level, and the minimum value Q1_min=P_min and the maximum value Q1_max=P_min+△P corresponding to the interval range Q1 of the first risk level; the minimum value Q2_min=P_min+△P and the maximum value Q2_max=P_min+2△P corresponding to the interval range Q2 of the second risk level; and so on, the minimum value QM_min=P_min+(M-1)△P and the maximum value QM_max=P_max corresponding to the interval range QM of the Mth risk level.

6. A data center security monitoring data management method according to claim 5, characterized in that: The step S400 includes: S401. At every selected time period T, all scripts and their data flow paths in the data center are obtained in real time. According to the analysis process from step S100 to step S300, a real-time script data set SD', a real-time script dependency graph G' and real-time special attention nodes are constructed, and the risk levels of all scripts in the current data center are obtained, and the real-time special attention nodes are stored; the identifiers of all scripts in the current data center are extracted from the real-time script data set SD'. If there are new scripts, the risk level U' of the new scripts is calculated according to the real-time script dependency graph G' and the real-time special attention nodes, and a risk level list of the new scripts is generated for relevant personnel; S402. For other scripts, extract the risk level U corresponding to the previous selected time period T and compare it with the current risk level U'. If the risk level U is less than the risk level U', it means that the risk level of the current script has increased, and generate a warning message to output to relevant personnel, where the warning message includes the corresponding script identifier; if the risk level U is greater than or equal to the risk level U', it means that the risk level of the current script has decreased or remains unchanged, and no warning message is generated.

7. A data center security monitoring data management system, applied to a data center security monitoring data management method according to any one of claims 1 to 6, characterized in that: The system includes: a script scanning and script data set building module, a script dependency analysis module, a risk assessment module, a real-time monitoring and dynamic risk assessment module, and an early warning information generation module; The script scanning and script data set construction module obtains all scripts and their data flow paths in the data center, assigns a unique identifier to each script, and draws a data flow diagram based on these identifiers, organizes the data flow diagram, and forms a script data set with the scripts and their data flow diagrams; The script dependency analysis module extracts the input and output information of each script according to the data flow diagram in the script data set, and constructs a dependency diagram between scripts; based on the script dependency diagram, calculates the in-degree, out-degree, and betweenness centrality of each script, and comprehensively evaluates the importance of each script in the script dependency diagram; The risk assessment module identifies and marks nodes of special concern based on the results of the script importance assessment; analyzes the impact of failures of nodes of special concern on other scripts, conducts risk assessment on all scripts, and divides the scripts into several risk levels based on the overall risk index; The real-time monitoring and dynamic risk assessment module acquires all scripts and their data flow paths in the data center in real time, identifies real-time special attention nodes based on the real-time acquired data, and performs risk assessment on all current scripts, thereby obtaining the risk levels of all current scripts; The warning information generation module generates corresponding warning information according to the results of risk assessment and real-time monitoring, and stores the real-time special attention nodes and the real-time risk levels of the newly added scripts.

8. A data center security monitoring data management system according to claim 7, characterized in that: The script scanning and script data set construction module includes a script scanning unit, a data flow path identification unit and a data flow graph construction unit; The script scanning unit scans all scripts in the data center, identifies and collects information of each script, and generates a script set and a data flow path set; the data flow path identification unit is used to identify the data flow path of each script; the data flow graph construction unit draws a data flow graph based on the script and its data flow path, and corresponds each script to the corresponding data flow graph to form a script data set; The script dependency analysis module includes an input and output information extraction unit, a script dependency graph construction unit, and an importance assessment unit; The input-output information extraction unit extracts the input information and output information of each script from the data flow graph and identifies all input nodes and output nodes; The script dependency graph building unit builds a dependency graph between scripts based on the extracted input and output information; The importance evaluation unit calculates the in-degree, out-degree, and betweenness centrality of each script, and comprehensively evaluates the importance of each script in the dependency graph to obtain an importance index.

9. A data center security monitoring data management system according to claim 7, characterized in that: The risk assessment module includes a special attention node identification unit, an influence degree calculation unit and an overall risk assessment unit; The special attention node identification unit identifies and marks the special attention nodes based on the script dependency graph and the importance evaluation result; The impact calculation unit calculates the impact of a special concern node failure on other scripts, and calculates the total impact value of each script; the overall risk assessment unit calculates the overall risk index of each script based on the special concern node and the impact, and divides all scripts into risk levels according to the overall risk index.

10. A data center security monitoring data management system according to claim 7, characterized in that: The real-time monitoring and dynamic risk assessment module includes a real-time data acquisition unit, a real-time special attention node identification unit and a real-time risk assessment unit; The real-time data acquisition unit periodically acquires all scripts and their data flow paths in the data center, and constructs a real-time script data set and a script dependency graph; The real-time special attention node identification unit identifies the special attention nodes in the current data flow graph according to the real-time data; The real-time risk assessment unit assesses the risk level of all current scripts based on the real-time script data set and dependency graph; The warning information generation module includes a new script risk assessment unit, a risk level change monitoring unit and a warning information generation unit; The newly added script risk assessment unit calculates the risk level of the newly added script and generates a corresponding risk assessment list; the risk level change monitoring unit monitors the risk level change of the script, determines whether the current risk level has increased, and generates warning information if it has increased; The warning information generating unit generates warning information according to the risk assessment result of the risk level change monitoring unit, and pushes it to relevant personnel.

Images