A data center security monitoring data management system and method

Abstract

The present invention discloses a data center security monitoring data management system and method, which relates to the technical field of data management. The system of the present invention includes: a script scanning and script data set construction module, a script dependency analysis module, a risk assessment module, a real-time monitoring and dynamic risk assessment module, and a warning information generation module; the script scanning and script data set construction module is responsible for obtaining scripts and their data flow paths and constructing a script data set; the script dependency analysis module constructs a script dependency graph based on the script data set and evaluates the importance of each script; the risk assessment module is used to identify nodes of special concern, calculate the degree of risk impact, and perform risk level classification; the real-time monitoring and dynamic risk assessment module is used to obtain scripts and data flow paths in real time to construct a real-time script dependency graph and perform real-time risk assessment; the warning information generation module is used to generate and output warning information.

Description

Technical Field

[0001] The present invention relates to the technical field of data analysis, and specifically to a data center security monitoring data management system and method. Background Technique

[0002] With the rapid development of information technology and the wide application of data centers, scripts have become increasingly important in automated tasks and system management. However, the execution of scripts also brings potential security risks, especially in large-scale and complex IT environments. The injection of malicious scripts, misoperations, or improper configurations may lead to data leakage, service interruption, or even system paralysis. Therefore, it is particularly important to build an effective security monitoring data management system to identify and handle these potential script security risks.

[0003] Existing data center security monitoring methods mostly adopt static analysis means, mainly focusing on network security and the security of hardware facilities. These methods have a certain effect in identifying potential threats, but they often cannot comprehensively cover the dynamic changes in data flow, resulting in difficulties in timely discovering and handling abnormal situations and potential risks during script execution. In addition, traditional methods lack systematicness in the evaluation of dependencies between scripts, input and output data streams, and key nodes, and cannot effectively identify key influencing factors and potential risks in the data flow process. Summary of the Invention

[0004] The purpose of the present invention is to provide a data center security monitoring data management system and method to solve the problems raised in the above background technique.

[0005] To solve the above technical problems, the present invention provides the following technical solutions:

[0006] A data center security monitoring data management method includes the following steps:

[0007] Step S100. Obtain all scripts in the data center and their data flow paths, assign a unique identifier to each script, summarize all scripts and their data flow paths based on the identifier, and draw a corresponding data flow diagram; organize the data flow diagram to form a script data set;

[0008] Step S200. According to the data flow diagram in the script data set, extract the input and output information of each script; construct a script dependency graph based on the input and output information of the script; evaluate the importance of each script in the script dependency graph based on the script dependency graph;

[0009] Step S300. Identify and label the nodes of special concern based on the evaluation results of the importance of each script in the script dependency graph; based on the script dependency graph, analyze the impact on the overall data flow when a node of special concern fails, so as to conduct a risk assessment on all other nodes in the script dependency graph except the nodes of special concern, and classify the risk levels of all scripts.

[0010] Step S400. At selected time intervals, obtain all the scripts in the data center and their data flow paths in real time, and construct a real-time script dependency graph; based on the real-time script dependency graph, identify the real-time nodes of special concern, classify the risk levels of all the scripts in the data center, and generate corresponding notification information according to the risk level classification results.

[0011] Further, step S100 includes:

[0012] S101. Use an automated tool to scan the data center, identify all the script information in the data center, and form a script set S, where S = {s1, s2,..., sn}, where s1 represents the first script information in the data center, s2 represents the second script information in the data center, and so on, and sn represents the nth script information in the data center; for each script si in each script set, capture the corresponding input and output paths, so as to construct the data flow path of each script, and represent it as a data flow path set P, where Pi = {p1, p2,..., pm}i, where p1 represents the first data flow path of the ith script, p2 represents the second data flow path of the ith script, and so on, and pm represents the mth data flow path of the ith script.

[0013] S102. Assign a unique identifier ID to each script si, where i is a positive integer between 1 and n; and mark the corresponding set of data flow paths P according to the identifier of the script, denoted as P(ID); summarize all scripts and their data flow paths based on the identifier, and use a graph theory model to represent each script and its data flow path as a directed graph, thereby obtaining the corresponding data flow graph D=(V,E), where V represents the set of nodes, and the set of nodes V represents all data nodes of the corresponding script; E represents the set of edges, and the set of edges E represents all data flow paths of the corresponding script; according to the identifier ID corresponding to the script, correspond each script to the corresponding data flow graph, thereby constructing a script data set SD, and SD={[ID(s1),D1],[ID(s2),D2],...,[ID(sn),Dn]}, where [ID(s1),D1] represents the data group composed of the identifier and the data flow graph corresponding to the first script in the data center, [ID(s2),D2] represents the data group composed of the identifier and the data flow graph corresponding to the second script in the data center, and so on, [ID(sn),Dn] represents the data group composed of the identifier and the data flow graph corresponding to the nth script in the data center.

[0014] Further, step S200 includes:

[0015] S201. According to the data flow graph in the script data set, for each script si, extract the input and output information from the corresponding data flow graph Dj, specifically including: for the input information, from the data flow graph Dj of the script si, identify all data inflow paths related to the script si, and record the nodes of these data inflow paths, thereby obtaining the input node set Ii of the script si; for the output information, from the data flow graph Di of the script si, identify all data outflow paths related to the script si, and record the nodes of these data outflow paths, thereby obtaining the output node set Oi of the script si.

[0016] S202. Based on the input and output information of each script, construct a dependency graph R=(S0,F) of the script, where S0 represents the set of nodes, and the set of nodes S0 corresponds to the set of scripts S, and each node in the set of nodes represents a script; F represents the set of edges, representing the dependency relationship between different scripts.

[0017] S203. Based on the script dependency graph, calculate the in-degree indegree and out-degree outdegree of each script, and the specific formulas are as follows:

[0018] indegree(si)=|sm|(sm,si)∈F|, where sm represents the script that depends on the script si;

[0019] outdegree(si) = |{sl|(si, sl) ∈ F}|, where sl represents the script depended on by script si;

[0020] Based on the in - degree indegree and out - degree outdegree, comprehensively calculate the influence Im of the script. The specific calculation formula is:

[0021] Im(si) = w1 × indegree(si)+w2 × outdegree(si), where w1 and w2 represent weight coefficients, and w1 + w2 = 1;

[0022] Calculate the betweenness centrality CB of each script, and the betweenness centrality is used to measure the degree of a script as a mediator in the dependency graph, representing the frequency of a script playing a mediating role in the data flow process. The specific calculation formula is:

[0023] CB(si)=∑sm≠sl≠si,σ(sm,sl|si) / σ(sm,sl),

[0024] Among them, σ(sm, sl) represents the number of shortest paths between scripts sm and sl, and σ(sm, sl|si) represents the number of shortest paths containing script si. Combining the in - degree, out - degree and betweenness centrality, comprehensively evaluate the importance of each script in the script dependency graph, so as to obtain the importance index Z. The specific calculation formula is: Z(si)=a × Im(si)+b × CB(si), where a and b represent influence factors.

[0025] Furthermore, the judgment of the dependency relationship between different scripts includes input - output relationship judgment and reverse dependency relationship judgment, specifically including:

[0026] For the input - output relationship judgment, if the output node set Oi of script si and the input node set Ij of script sj have an intersection, it means that script sj depends on script si, and an edge (si, sj) is added to the dependency graph, where j takes positive integers between 1 and n, and i ≠ j;

[0027] For the reverse dependency relationship judgment, if the output node set Oj of script sj and the input node set Ii of script si have an intersection, it means that script si depends on script sj, and script si must wait for script sj to complete execution before it can perform its own operations;

[0028] Combining the input - output relationship judgment and the reverse dependency relationship judgment, the construction rule of the edge set F in the dependency graph is: F = {(si, sj)|Oi ∩ Ij ≠ 0 or Oj ∩ Ii ≠ 0, 1 ≤ i, j ≤ n}.

[0029] Although both of these dependencies describe the associations between scripts, their meanings and impacts are different. Specifically: Forward dependency (input-output relationship determination): Emphasizes that the output of a certain script is a prerequisite for the execution of another script. This dependency usually represents the direction of data flow and is a common data transfer dependency relationship; Reverse dependency (reverse dependency relationship determination): Emphasizes that a script needs to wait for another script to finish executing before it can continue; it pays more attention to the dependency of execution timing, that is, the script executed first (reverse dependency) will affect the start time of the script executed later. This relationship is more reflected in scheduling and control flow.

[0030] Furthermore, step S300 includes:

[0031] S301. Obtain the importance degree index of all scripts in the script dependency graph, calculate the corresponding average value Zμ and standard deviation Zσ, calculate the corresponding importance degree index threshold Z0, and Z0 = Zμ + k×Zσ, where k represents a coefficient; if there exists a script si whose importance degree index Z(si) ≥ the importance degree index threshold Z0, then mark the script si as a special attention node sf in the script dependency graph; summarize all the special attention nodes in the script dependency graph to form a special attention node set F;

[0032] S302. Based on the script dependency graph, assuming that the special attention node sf fails, calculate the degree I(sf, sj) to which each other script sj in the script dependency graph is affected by the failure of the special attention node sf, and the specific calculation formula is:

[0033] I(sf, sj) = 1 / [1 + d(sf, sj)],

[0034] where d(si, sj) represents the shortest path length from the special attention node sf to the script sj; for each script sj, calculate its total degree of influence value I(sj), and I(sj) = ∑sf∈F, I(sf, sj);

[0035] S303. According to the total degree of influence value I(sj) corresponding to each script sj, and combined with the corresponding importance degree index Z(sj), calculate the corresponding overall risk index P(sj), and the calculation formula is:

[0036] P(sj) = λ×I(sj) + (1 - λ)×Z(sj),

[0037] where λ represents a weight coefficient; for the special attention node, calculate the corresponding overall risk index P(sf), and the specific calculation formula is:

[0038] P(sj) = λ×N(f) + (1 - λ)×Z(sj),

[0039] Where N(f) represents the number of nodes of special concern in the set F of nodes of special concern;

[0040] S304. Aggregate the overall risk indices P corresponding to all scripts. According to the magnitudes of the overall risk indices, divide all scripts into several risk levels U. The specific risk level division process is as follows:

[0041] Assume that the number of risk levels U is M, and the risk level numbers are: U1, U2,..., UM, where U1 has the lowest risk level and UM has the highest risk level;

[0042] Arrange the overall risk indices P corresponding to all scripts in descending order, so as to extract the maximum value P_max and the minimum value P_min in the overall risk index; Based on the maximum value P_max and the minimum value P_min in the overall risk index, calculate the corresponding span value △P for dividing the risk levels, and △P = (P_max - P_min) / M; According to the span value △P, calculate the interval range Q for each risk level, and the minimum value Q1_min corresponding to the interval range Q1 of the first risk level is P_min, and the maximum value Q1_max = P_min + △P; The minimum value Q2_min corresponding to the interval range Q2 of the second risk level is P_min + △P, and the maximum value Q2_max = P_min + 2△P; And so on, the minimum value QM_min corresponding to the interval range QM of the Mth risk level is P_min + (M - 1)△P, and the maximum value QM_max = P_max.

[0043] Furthermore, step S400 includes:

[0044] S401. Every other selected time period T, obtain all scripts and their data flow paths in the data center in real time. According to the analysis process from step S100 to step S300, construct a real-time script data set SD', a real-time script dependency graph G', and real-time nodes of special concern, and obtain the risk levels of all scripts in the current data center, and store the real-time nodes of special concern; Extract the identifiers of all scripts in the current data center from the real-time script data set SD'. If there are newly added scripts, calculate the risk level U' of the newly added scripts according to the real-time script dependency graph G' and the real-time nodes of special concern, and generate a list of the risk levels of the newly added scripts for relevant personnel;

[0045] S402. If there is no newly added script, extract the risk level U corresponding to the previous selected time period T and compare it with the current risk level U'. If the risk level U < the risk level U', it means that the risk level of the current script has increased, and a warning message is generated and output to the relevant personnel, where the warning message includes the corresponding script identifier; if the risk level U ≥ the risk level U', it means that the risk level of the current script has decreased or remained unchanged, and no warning message is generated.

[0046] A data center security monitoring data management system includes: a script scanning and script dataset construction module, a script dependency analysis module, a risk assessment module, a real-time monitoring and dynamic risk assessment module, and a warning message generation module;

[0047] The script scanning and script dataset construction module obtains all the scripts and their data flow paths in the data center, assigns a unique identifier to each script, and draws a data flow diagram based on these identifiers, organizes the data flow diagram, and forms a script dataset with the scripts and their data flow diagrams;

[0048] The script dependency analysis module extracts the input and output information of each script according to the data flow diagram in the script dataset and constructs a dependency relationship diagram between the scripts; based on the script dependency relationship diagram, calculates the in-degree, out-degree, and betweenness centrality of each script, and comprehensively evaluates the importance of each script in the script dependency relationship diagram;

[0049] The risk assessment module identifies and marks the nodes that require special attention according to the evaluation result of the importance of the scripts; analyzes the impact degree of other scripts when the nodes that require special attention fail, conducts a risk assessment on all scripts, and divides the scripts into several risk levels according to the overall risk index;

[0050] The real-time monitoring and dynamic risk assessment module obtains all the scripts and their data flow paths in the data center in real time, identifies the real-time nodes that require special attention according to the real-time obtained data, conducts a risk assessment on all the current scripts, and thus obtains the risk levels of all the current scripts;

[0051] The warning message generation module generates corresponding warning messages according to the results of the risk assessment and real-time monitoring, and stores the real-time risk levels of the real-time nodes that require special attention and the newly added scripts.

[0052] Furthermore, the script scanning and script dataset construction module includes a script scanning unit, a data flow path identification unit, and a data flow diagram construction unit;

[0053] The script scanning unit scans all scripts in the data center, identifies and collects information for each script, generates a script set and a data flow path set; the data flow path identification unit is used to identify the data flow paths of each script; the data flow graph construction unit draws a data flow graph based on the scripts and their data flow paths, and corresponds each script with the corresponding data flow graph to form a script data set.

[0054] The script dependency analysis module includes an input / output information extraction unit, a script dependency graph construction unit, and an importance evaluation unit.

[0055] The input / output information extraction unit extracts the input information and output information of each script from the data flow graph and identifies all input nodes and output nodes; the script dependency graph construction unit constructs a dependency graph between scripts based on the extracted input and output information; the importance evaluation unit calculates the in-degree, out-degree, and betweenness centrality of each script, and comprehensively evaluates the importance of each script in the dependency graph to obtain an importance index.

[0056] Furthermore, the risk assessment module includes a special attention node identification unit, an impact degree calculation unit, and an overall risk assessment unit.

[0057] The special attention node identification unit identifies and marks special attention nodes based on the script dependency graph and the importance evaluation results; the impact degree calculation unit calculates the impact degree on other scripts when a special attention node fails, and calculates the total impact value of each script; the overall risk assessment unit calculates the overall risk index of each script based on the special attention nodes and the impact degree, and divides the risk levels of all scripts according to the overall risk index.

[0058] Furthermore, the real-time monitoring and dynamic risk assessment module includes a real-time data collection unit, a real-time special attention node identification unit, and a real-time risk assessment unit.

[0059] The real-time data collection unit regularly obtains all scripts in the data center and their data flow paths, and constructs a real-time script data set and a script dependency graph; the real-time special attention node identification unit identifies special attention nodes in the current data flow graph according to the real-time data; the real-time risk assessment unit evaluates the risk levels of all current scripts according to the real-time script data set and the dependency graph.

[0060] The warning information generation module includes a new script risk assessment unit, a risk level change monitoring unit, and a warning information generation unit.

[0061] The newly added script risk assessment unit calculates the risk level of the newly added script and generates a corresponding risk assessment list; the risk level change monitoring unit monitors the change in the risk level of the script, determines whether the current risk level has increased, and generates a warning message if there is an increase; the warning message generation unit generates a warning message based on the risk assessment result of the risk level change monitoring unit and pushes it to relevant personnel.

[0062] Compared with the prior art, the beneficial effects of the present invention are as follows: By comprehensively scanning and summarizing all scripts and their data flow paths in the data center, the present invention can identify in detail the input and output information of each script and its dependencies, forming a clear data flow diagram and script dependency diagram; this comprehensive and systematic monitoring method helps to detect potential risks in a timely manner and reduce the probability of data leakage or system failures. Based on multiple parameters such as in-degree, out-degree, and betweenness centrality, the present invention comprehensively evaluates the importance and influence of each script in the dependency diagram; in addition, by calculating the overall risk index of each script, it can effectively identify key scripts that require special attention and evaluate their risk levels according to their impact on the overall system; this comprehensive evaluation method enables the data center to conduct risk monitoring at a finer granularity, thereby enhancing security. By combining the risk index of the script with the selected risk level classification rules, the present invention can divide all scripts into multiple risk levels, forming a detailed risk level management system; this quantitative risk level classification enables managers to clearly understand the security status of each script, helps to prioritize the handling of high-risk scripts, and improves the overall security of the data center. The real-time monitoring function of the present invention enables the data center to dynamically evaluate the risk level of each script according to real-time data flow and script status, and to mark the nodes that require special attention in real time; if it is found that the risk level of any script has increased, the system can generate a warning message in a timely manner to notify relevant personnel to take measures; this real-time risk assessment and warning mechanism can effectively prevent the occurrence of security incidents and ensure the stability of the system. The present invention can monitor the addition or change of scripts in real time, and quickly evaluate its impact on the overall system security according to the dependencies and risk indices of the newly added scripts; this mechanism ensures that the data center will not cause potential security hazards due to lack of adaptability when facing script updates. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] The drawings are used to provide a further understanding of the present invention, and constitute a part of the specification. They are used together with the embodiments of the present invention to explain the present invention, and do not constitute a limitation to the present invention. In the drawings:

[0064] Figure 1 It is a schematic diagram of the modules of a data center security monitoring data management system according to the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0065] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative work shall fall within the protection scope of the present invention.

[0066] Please refer to Figure 1 , the present invention provides a technical solution:

[0067] A data center security monitoring data management system, including: a script scanning and script dataset construction module, a script dependency analysis module, a risk assessment module, a real-time monitoring and dynamic risk assessment module, and a warning information generation module;

[0068] The script scanning and script dataset construction module obtains all scripts and their data flow paths in the data center, assigns a unique identifier to each script, and draws a data flow diagram based on these identifiers, sorts out the data flow diagram, and forms a script dataset with the scripts and their data flow diagrams;

[0069] The script dependency analysis module extracts the input and output information of each script according to the data flow diagram in the script dataset, and constructs a dependency relationship graph between the scripts; based on the script dependency relationship graph, calculates the in-degree, out-degree, and betweenness centrality of each script, and comprehensively evaluates the importance of each script in the script dependency relationship graph;

[0070] The risk assessment module identifies and marks the nodes of special concern according to the evaluation result of the importance of the scripts; analyzes the impact degree of other scripts when the nodes of special concern fail, conducts a risk assessment on all scripts, and divides the scripts into several risk levels according to the overall risk index;

[0071] The real-time monitoring and dynamic risk assessment module obtains all scripts and their data flow paths in the data center in real time, identifies the real-time nodes of special concern according to the real-time obtained data, conducts a risk assessment on all current scripts, and thus obtains the risk levels of all current scripts;

[0072] The warning information generation module generates corresponding warning information according to the results of risk assessment and real-time monitoring, and stores the real-time risk levels of the real-time nodes of special concern and the newly added scripts.

[0073] The script scanning and script dataset construction module includes a script scanning unit, a data flow path identification unit, and a data flow diagram construction unit;

[0074] The script scanning unit scans all scripts in the data center, identifies and collects information for each script, generates a set of scripts and a set of data flow paths; the data flow path identification unit is used to identify the data flow paths of each script; the data flow graph construction unit draws a data flow graph based on the scripts and their data flow paths, and corresponds each script with the corresponding data flow graph to form a script data set;

[0075] The script dependency analysis module includes an input / output information extraction unit, a script dependency graph construction unit, and an importance evaluation unit;

[0076] The input / output information extraction unit extracts the input information and output information of each script from the data flow graph and identifies all input nodes and output nodes; the script dependency graph construction unit constructs a dependency graph between scripts based on the extracted input and output information; the importance evaluation unit calculates the in-degree, out-degree, and betweenness centrality of each script, and comprehensively evaluates the importance of each script in the dependency graph to obtain an importance index.

[0077] The risk assessment module includes a special attention node identification unit, an impact degree calculation unit, and an overall risk assessment unit;

[0078] The special attention node identification unit identifies and marks special attention nodes based on the script dependency graph and the importance evaluation results; the impact degree calculation unit calculates the impact degree on other scripts when a special attention node fails, and calculates the total impact value of each script; the overall risk assessment unit calculates the overall risk index of each script based on the special attention nodes and the impact degree, and divides the risk levels of all scripts according to the overall risk index.

[0079] The real-time monitoring and dynamic risk assessment module includes a real-time data acquisition unit, a real-time special attention node identification unit, and a real-time risk assessment unit;

[0080] The real-time data acquisition unit regularly obtains all scripts in the data center and their data flow paths, and constructs a real-time script data set and a script dependency graph; the real-time special attention node identification unit identifies the special attention nodes in the current data flow graph according to the real-time data; the real-time risk assessment unit evaluates the risk levels of all current scripts according to the real-time script data set and the dependency graph.

[0081] The warning information generation module includes a new script risk assessment unit, a risk level change monitoring unit, and a warning information generation unit;

[0082] The newly added script risk assessment unit calculates the risk level of the newly added script and generates a corresponding risk assessment list; the risk level change monitoring unit monitors the change in the risk level of the script, determines whether the current risk level has increased, and generates a warning message if it has increased; the warning message generation unit generates a warning message based on the risk assessment result of the risk level change monitoring unit and pushes it to relevant personnel.

[0083] A data center security monitoring data management method includes the following steps:

[0084] Step S100. Obtain all the scripts in the data center and their data flow paths, assign a unique identifier to each script, summarize all the scripts and their data flow paths based on the identifier, and draw a corresponding data flow diagram; organize the data flow diagram to form a script data set.

[0085] Step S200. Extract the input and output information of each script according to the data flow diagram in the script data set; construct a script dependency graph based on the input and output information of the script; evaluate the importance of each script in the script dependency graph based on the script dependency graph.

[0086] Step S300. Identify and label the nodes that require special attention according to the evaluation result of the importance of each script in the script dependency graph; analyze the impact on the overall data flow when the nodes that require special attention fail based on the script dependency graph, so as to conduct a risk assessment on all other nodes except the nodes that require special attention in the script dependency graph and divide the risk levels of all scripts.

[0087] Step S400. Every selected time period, obtain all the scripts in the data center and their data flow paths in real time and construct a real-time script dependency graph; identify the real-time nodes that require special attention based on the real-time script dependency graph, divide the risk levels of all the scripts in the data center, and generate corresponding notification information according to the risk level division result.

[0088] Step S100 includes:

[0089] S101. Use an automated tool to scan the data center, identify all the script information in the data center, and form a script set S, where S = {s1, s2,..., sn}, s1 represents the first script information in the data center, s2 represents the second script information in the data center, and so on, sn represents the nth script information in the data center; for each script si in each script set, capture the corresponding input and output paths, thereby constructing the data flow path of each script, and representing it as a data flow path set P, where Pi = {p1, p2,..., pm}i, p1 represents the first data flow path of the ith script, p2 represents the second data flow path of the ith script, and so on, pm represents the mth data flow path of the ith script;

[0090] S102. Assign a unique identifier ID to each script si, where i is a positive integer between 1 and n; and mark the corresponding data flow path set P according to the identifier of the script, denoted as P(ID); summarize all the scripts and their data flow paths based on the identifier, and use a graph theory model to represent each script and its data flow path as a directed graph, thereby obtaining the corresponding data flow graph D = (V, E), where V represents the node set, and the node set V represents all the data nodes of the corresponding script; E represents the edge set, and the edge set E represents all the data flow paths of the corresponding script; according to the identifier ID of the script, correspond each script to the corresponding data flow graph, thereby forming a script data set SD, where SD = {[ID(s1), D1], [ID(s2), D2],..., [ID(sn), Dn]}, [ID(s1), D1] represents the data group composed of the identifier corresponding to the first script in the data center and the data flow graph, [ID(s2), D2] represents the data group composed of the identifier corresponding to the second script in the data center and the data flow graph, and so on, [ID(sn), Dn] represents the data group composed of the identifier corresponding to the nth script in the data center and the data flow graph.

[0091] Step S200 includes:

[0092] S201. According to the data flow graph in the script data set, for each script si, extract the input and output information from the corresponding data flow graph Dj, specifically including: for the input information, from the data flow graph Dj of the script si, identify all the data inflow paths related to the script si, and record the nodes of these data inflow paths, thereby obtaining the input node set Ii of the script si; for the output information, from the data flow graph Di of the script si, identify all the data outflow paths related to the script si, and record the nodes of these data outflow paths, thereby obtaining the output node set Oi of the script si.

[0093] S202. For the input and output information of each script, construct a dependency graph R=(S0,F) of the scripts, where S0 represents the set of nodes, and the set of nodes S0 corresponds to the set of scripts S. Each node in the set of nodes represents a script; F represents the set of edges, indicating the dependency relationships between different scripts;

[0094] S203. Based on the script dependency graph, calculate the in-degree indegree and out-degree outdegree of each script. The specific formulas are as follows:

[0095] indegree(si)=|sm|(sm,si)∈F|, where sm represents the script that depends on script si;

[0096] outdegree(si)=|sl|(si,sl)∈F|, where sl represents the script that is depended on by script si;

[0097] According to the in-degree indegree and out-degree outdegree, comprehensively calculate the influence Im of the script. The specific calculation formula is:

[0098] Im(si)=w1×indegree(si)+w2×outdegree(si), where w1 and w2 represent the weight coefficients, and w1+w2=1;

[0099] Calculate the betweenness centrality CB of each script, and the betweenness centrality is used to measure the degree of a script as a mediator in the dependency graph, indicating the frequency of a script playing a mediating role in the data flow process; the specific calculation formula is:

[0100] CB(si)=∑sm≠sl≠si,σ(sm,sl|si) / σ(sm,sl),

[0101] where, σ(sm,sl) represents the number of shortest paths between script sm and sl, and σ(sm,sl|si) represents the number of shortest paths that include script si; combining the in-degree, out-degree and betweenness centrality, comprehensively evaluate the importance of each script in the script dependency graph, so as to obtain the importance index Z. The specific calculation formula is: Z(si)=a×Im(si)+b×CB(si), where a and b represent the influence factors.

[0102] The judgment of the dependency relationships between different scripts includes input-output relationship judgment and reverse dependency relationship judgment, specifically including:

[0103] For the determination of the input-output relationship, if the output node set Oi of script si has an intersection with the input node set Ij of script sj, it means that script sj depends on script si, and an edge (si, sj) is added to the dependency graph, where j takes positive integers between 1 and n, and i ≠ j;

[0104] For the determination of the reverse dependency relationship, if the output node set Oj of script sj has an intersection with the input node set Ii of script si, it means that script si depends on script sj, and script si must wait for script sj to complete execution before it can perform its own operations;

[0105] Combining the determination of the input-output relationship and the determination of the reverse dependency relationship, the construction rule for the set F of edges in the dependency graph is: F = {(si, sj) | Oi ∩ Ij ≠ 0 or Oj ∩ Ii ≠ 0, 1 ≤ i, j ≤ n}.

[0106] Although both of these dependency relationships describe the associations between scripts, their meanings and impacts are different. Specifically: Forward dependency (determination of the input-output relationship): Emphasizes that the output of a certain script is a prerequisite for the execution of another script. This kind of dependency usually represents the direction of data flow and is a common data transfer dependency relationship; Reverse dependency (determination of the reverse dependency relationship): Emphasizes that a script needs to wait for another script to finish executing before it can continue to execute; it pays more attention to the dependency of the execution timing, that is, the script that executes first (reverse dependency) will affect the start time of the script that executes later. This relationship is more reflected in scheduling and control flow.

[0107] Step S300 includes:

[0108] S301. Obtain the importance degree index of all scripts in the script dependency graph, calculate the corresponding average value Zμ and standard deviation Zσ, calculate the corresponding importance degree index threshold Z0, and Z0 = Zμ + k × Zσ, where k represents a coefficient; if there exists a script si whose importance degree index Z(si) ≥ the importance degree index threshold Z0, then mark script si as a special attention node sf in the script dependency graph; summarize all the special attention nodes in the script dependency graph to form the special attention node set F;

[0109] S302. Based on the script dependency graph, assuming that the special attention node sf fails, calculate the degree I(sf, sj) to which each other script sj in the script dependency graph is affected by the failure of the special attention node sf, and the specific calculation formula is:

[0110] I(sf, sj) = 1 / [1 + d(sf, sj)],

[0111] Among them, d(si, sj) represents the shortest path length from the specially concerned node sf to the script sj; for each script sj, calculate its total degree of influence value I(sj), and I(sj) = ∑sf∈F, I(sf, sj);

[0112] S303. According to the total degree of influence value I(sj) corresponding to each script sj, and combined with the corresponding importance index Z(sj), calculate the corresponding overall risk index P(sj), and the calculation formula is:

[0113] P(sj) = λ × I(sj) + (1 - λ) × Z(sj),

[0114] Among them, λ represents the weight coefficient; for the specially concerned node, calculate the corresponding overall risk index P(sf), and the specific calculation formula is:

[0115] P(sj) = λ × N(f) + (1 - λ) × Z(sj),

[0116] Among them, N(f) represents the number of specially concerned nodes in the set F of specially concerned nodes;

[0117] S304. Aggregate the overall risk indices P corresponding to all scripts. According to the magnitudes of the overall risk indices, divide all scripts into several risk levels U. The specific risk level division process is as follows:

[0118] Assume that the number of risk levels U is M, and the risk level numbers are: U1, U2,..., UM, where U1 has the lowest risk level and UM has the highest risk level;

[0119] Arrange the overall risk indices P corresponding to all scripts in descending order, so as to extract the maximum value P_max and the minimum value P_min in the overall risk index; based on the maximum value P_max and the minimum value P_min in the overall risk index, calculate the corresponding span value △P for dividing the risk levels, and △P = (P_max - P_min) / M; according to the span value △P, calculate the interval range Q for each risk level. The minimum value Q1_min of the interval range Q1 of the first risk level is P_min, and the maximum value Q1_max = P_min + △P; the minimum value Q2_min of the interval range Q2 of the second risk level is P_min + △P, and the maximum value Q2_max = P_min + 2△P; and so on. The minimum value QM_min of the interval range QM of the Mth risk level is P_min + (M - 1)△P, and the maximum value QM_max = P_max.

[0120] In this embodiment, assume that the overall risk indices of the scripts in the data center are arranged in descending order. Obtain the corresponding maximum value P_max and minimum value P_min, where P_max = 15, P_min = 5, and M = 4. Calculate the corresponding span value △P for dividing the risk levels, and △P = (P_max - P_min) / M = 2.5. Then, the interval range Q1 corresponding to the risk level U1 is [5, 7.5), the interval range Q2 corresponding to the risk level U2 is [7.5, 10), the interval range Q3 corresponding to the risk level U3 is [10, 12.5), and the interval range Q4 corresponding to the risk level U4 is [12.5, 15].

[0121] Step S400 includes:

[0122] S401. Every other selected time period T, obtain all the scripts in the data center and their data flow paths in real time. According to the analysis process from step S100 to step S300, construct a real-time script dataset SD’, a real-time script dependency graph G’, and real-time particularly concerned nodes, and obtain the risk levels of all the scripts in the current data center. Store the real-time particularly concerned nodes. Extract the identifiers of all the scripts in the current data center from the real-time script dataset SD’. If there are new scripts, calculate the risk level U’ of the new scripts according to the real-time script dependency graph G’ and the real-time particularly concerned nodes, and generate a risk level list of the new scripts for relevant personnel.

[0123] S402. If there are no new scripts, extract the risk level U corresponding to the previous selected time period T and compare it with the current risk level U’. If the risk level U < the risk level U’, it means that the risk level of the current script has increased, and generate a warning message and output it to relevant personnel, where the warning message includes the corresponding script identifier. If the risk level U ≥ the risk level U’, it means that the risk level of the current script has decreased or remained unchanged, and no warning message is generated.

[0124] In this embodiment, assume that the script risk levels in time period T1 (the previous time period) are:

[0125] Script A: UA = 4;

[0126] Script B: UB = 1;

[0127] Script C: UC = 3;

[0128] The script risk levels in time period T2 (the current time period):

[0129] Script A: UA’ = 2;

[0130] Script B: UB’ = 4;

[0131] Script C: UC’ = 3;

[0132] Newly added script D: UD’ = 2;

[0133] For script A:

[0134] Risk level in the previous time period: UA = 4; Risk level in the current time period: UA’ = 2; Since UA > UA’, it indicates that the risk level of the current script has decreased, so no warning information is generated;

[0135] For script B:

[0136] Risk level in the previous time period: UB = 1; Risk level in the current time period: UB’ = 4; Since UB < UB’, the risk level of the current script has increased, and warning information is generated and output to relevant personnel;

[0137] For script C:

[0138] Risk level in the previous time period: UC = 3; Risk level in the current time period: UC’ = 3; Since UB = UB’, the risk level of the current script remains unchanged, so no warning information is generated;

[0139] For the newly added script D, according to the risk level in the current time period: UD’ = 2, a risk level list of the newly added script is generated for relevant personnel.

[0140] It should be noted that in this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the term "comprising", "including" or any other variant thereof is intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements not only includes those elements, but also includes other elements not expressly listed, or elements inherent to such process, method, article or device.

[0141] Finally, it should be noted that the above are only the preferred embodiments of the present invention and are not used to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some of the technical features. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principle of the present invention shall be included within the protection scope of the present invention.

Claims

1. A method for managing data center security monitoring data, characterized in that: The method includes the following steps: Step S100. Obtain all the scripts in the data center and their data flow paths, assign a unique identifier to each script, summarize all the scripts and their data flow paths based on the identifier, and draw the corresponding data flow diagram; organize the data flow diagram to form a script data set; Step S200. According to the data flow diagram in the script data set, extract the input and output information of each script; construct a script dependency graph based on the input and output information of the script; evaluate the importance of each script in the script dependency graph based on the script dependency graph; Step S300. According to the importance evaluation results of each script in the script dependency graph, identify and label the nodes of special concern; based on the script dependency graph, analyze the impact degree on the overall data flow when the nodes of special concern fail, so as to conduct a risk assessment on all other nodes except the nodes of special concern in the script dependency graph, and classify all the scripts into risk levels; The step S300 includes: S301. Obtain the importance degree index of all the scripts in the script dependency graph, calculate the corresponding average value Zμ and standard deviation Zσ, calculate the corresponding importance degree index threshold Z0, and Z0 = Zμ + k×Zσ, where k represents a coefficient; if there exists a script si whose importance degree index Z(si) ≥ the importance degree index threshold Z0, then mark the script si as a node of special concern sf in the script dependency graph; summarize the nodes of special concern in all the script dependency graphs to form a set of nodes of special concern F; S302. Based on the script dependency graph, assume that when the node of special concern sf fails, calculate the degree of influence I(sf, sj) of each other script sj in the script dependency graph affected by the failure of the node of special concern sf, and the specific calculation formula is: I(sf, sj)=1 / [1 + d(sf, sj)], where d(si, sj) represents the shortest path length from the node of special concern sf to the script sj; for each script sj, calculate its total degree of influence value I(sj), and I(sj)=∑sf∈F, I(sf, sj); S303. According to the total degree of influence value I(sj) corresponding to each script sj, and combined with the corresponding importance degree index Z(sj), calculate the corresponding overall risk index P(sj), and the calculation formula is: P(sj)=λ×I(sj)+(1 - λ)×Z(sj), where λ represents a weight coefficient; for the node of special concern, calculate the corresponding overall risk index P(sf), and the specific calculation formula is: P(sj)=λ×N(f)+(1 - λ)×Z(sj), where N(f) represents the number of nodes of special concern in the set of nodes of special concern F; S304. Summarize the overall risk index P corresponding to all the scripts, and classify all the scripts into several risk levels U according to the size of the overall risk index. The specific risk level classification process is as follows: Assume that the number of risk levels U is M, and the risk level numbers are: U1, U2,..., UM, where U1 has the lowest risk level and UM has the highest risk level; Arrange all the overall risk indices P corresponding to the scripts in descending order to extract the maximum value P_max and the minimum value P_min in the overall risk index; Based on the maximum value P_max and the minimum value P_min in the overall risk index, calculate the corresponding span value △P for dividing the risk levels, and △P = (P_max - P_min) / M; According to the span value △P, calculate the interval range Q for each risk level, and the minimum value Q1_min of the interval range Q1 corresponding to the first risk level is P_min, and the maximum value Q1_max is P_min + △P; The minimum value Q2_min of the interval range Q2 corresponding to the second risk level is P_min + △P, and the maximum value Q2_max is P_min + 2△P; And so on, the minimum value QM_min of the interval range QM corresponding to the Mth risk level is P_min + (M - 1)△P, and the maximum value QM_max is P_max; Step S400. At every selected time period, obtain all the scripts in the data center and their data flow paths in real time, and construct a real-time script dependency graph; Based on the real-time script dependency graph, identify the real-time nodes of special concern, classify the risk levels of all the scripts in the data center, and generate corresponding notification information according to the risk level classification results.

2. The data center security monitoring data management method according to claim 1, characterized in that: The said step S100 includes: S101. Use an automated tool to scan the data center, identify all the script information in the data center, and form a script set S, and S = {s1, s2,..., sn}, where s1 represents the first script information in the data center, s2 represents the second script information in the data center, and so on, sn represents the nth script information in the data center; For each script si in each script set, capture the corresponding input and output paths, thereby constructing the data flow path of each script, and represent it as a data flow path set P, and Pi = {p1, p2,..., pm}i, where p1 represents the first data flow path of the ith script, p2 represents the second data flow path of the ith script, and so on, pm represents the mth data flow path of the ith script; S102. Assign a unique identifier ID to each script si, where i is a positive integer between 1 and n; and label the corresponding data flow path set P according to the identifier of the script, denoted as P(ID); summarize all scripts and their data flow paths based on the identifier, and use a graph theory model to represent each script and its data flow path as a directed graph, so as to obtain the corresponding data flow graph D=(V,E), where V represents the set of nodes, and the set of nodes V represents all data nodes of the corresponding script; E represents the set of edges, and the set of edges E represents all data flow paths of the corresponding script; according to the identifier ID of the script, correspond each script with the corresponding data flow graph, so as to form a script data set SD, and SD={[ID(s1),D1],[ID(s2),D2],...,[ID(sn),Dn]}, where [ID(s1),D1] represents the data group composed of the identifier and the data flow graph corresponding to the first script in the data center, [ID(s2),D2] represents the data group composed of the identifier and the data flow graph corresponding to the second script in the data center, and so on, [ID(sn),Dn] represents the data group composed of the identifier and the data flow graph corresponding to the nth script in the data center.

3. A method for managing data of a data center security monitoring according to claim 2, characterized in that: The step S200 includes: S201. According to the data flow graph in the script data set, for each script si, extract the input and output information from the corresponding data flow graph Dj, specifically including: for the input information, from the data flow graph Dj of the script si, identify all data inflow paths related to the script si, and record the nodes of these data inflow paths, so as to obtain the input node set Ii of the script si; for the output information, from the data flow graph Di of the script si, identify all data outflow paths related to the script si, and record the nodes of these data outflow paths, so as to obtain the output node set Oi of the script si. S202. Based on the input and output information of each script, construct a dependency graph R=(S0,F) of the script, where S0 represents the set of nodes, and the set of nodes S0 corresponds to the script set S, and each node in the set of nodes represents a script; F represents the set of edges, representing the dependency relationship between different scripts. S203. Based on the script dependency graph, calculate the in-degree indegree and out-degree outdegree of each script. The specific formulas are as follows: indegree(si)=|sm|(sm,si)∈F|, where sm represents the script that depends on the script si. outdegree(si)=|sl|(si,sl)∈F|, where sl represents the script that is depended on by the script si. According to the in-degree indegree and out-degree outdegree, comprehensively calculate the influence Im of the script. The specific calculation formula is: Im(si)=w1×indegree(si)+w2×outdegree(si), where w1 and w2 represent weight coefficients, and w1+w2=1. Calculate the betweenness centrality CB of each script, and the betweenness centrality is used to measure the degree of a script acting as a mediator in the dependency graph, representing the frequency of a script playing a mediating role in the data flow process; the specific calculation formula is: CB(si)=∑sm≠sl≠si,σ(sm,sl|si) / σ(sm,sl), where σ(sm,sl) represents the number of shortest paths between scripts sm and sl, and σ(sm,sl|si) represents the number of shortest paths containing script si; combining the in-degree, out-degree, and betweenness centrality, comprehensively evaluate the importance of each script in the script dependency graph, so as to obtain the importance index Z, and the specific calculation formula is: Z(si)=a×Im(si)+b×CB(si), where a and b represent influence factors.

4. A method for managing data of a data center security monitoring according to claim 3, characterized in that: The determination of the dependency relationship between different scripts includes input-output relationship determination and reverse dependency relationship determination, specifically including: For the input-output relationship determination, if the output node set Oi of script si intersects with the input node set Ij of script sj, it means that script sj depends on script si, and an edge (si, sj) is added to the dependency graph, where j takes a positive integer between 1 and n, and i≠j; For the reverse dependency relationship determination, if the output node set Oj of script sj intersects with the input node set Ii of script si, it means that script si depends on script sj, and script si must wait for script sj to complete execution before it can perform its own operations; Combining the input-output relationship determination and the reverse dependency relationship determination, the construction rule of the set F of edges in the dependency graph is: F={(si,sj)|Oi∩Ij≠0 or Oj∩Ii≠0, 1≤i,j≤n}.

5. A method for managing data in data center security monitoring according to claim 1, characterized in that: The step S400 includes: S401. Every other selected time period T, obtain all scripts and their data flow paths in the data center in real time. According to the analysis process from step S100 to step S300, construct a real-time script data set SD’, a real-time script dependency graph G’, and real-time nodes of special concern, and obtain the risk levels of all scripts in the current data center, and store the real-time nodes of special concern; extract the identifiers of all scripts in the current data center from the real-time script data set SD’. If there are new scripts, calculate the risk level U’ of the new scripts according to the real-time script dependency graph G’ and the real-time nodes of special concern, and generate a risk level list of the new scripts for relevant personnel; S402. If there are no new scripts, extract the risk level U corresponding to the previous selected time period T and compare it with the current risk level U’. If the risk level U < the risk level U’, it means that the risk level of the current script has increased, and a warning message is generated and output to relevant personnel, where the warning message includes the corresponding script identifier; if the risk level U≥the risk level U’, it means that the risk level of the current script has decreased or remained unchanged, and no warning message is generated.

6. A data center security monitoring data management system, which is applied to the data center security monitoring data management method described in any one of claims 1-5, and is characterized in that: The system includes: a script scanning and script dataset construction module, a script dependency analysis module, a risk assessment module, a real-time monitoring and dynamic risk assessment module, and a warning information generation module; The script scanning and script dataset construction module obtains all scripts and their data flow paths in the data center, assigns a unique identifier to each script, draws a data flow diagram based on these identifiers, arranges the data flow diagram, and forms a script dataset with the scripts and their data flow diagrams; The script dependency analysis module extracts the input and output information of each script according to the data flow diagram in the script dataset, and constructs a dependency graph between scripts; based on the script dependency graph, calculates the in-degree, out-degree, and betweenness centrality of each script, and comprehensively evaluates the importance of each script in the script dependency graph; The risk assessment module identifies and marks the nodes of special concern according to the evaluation result of the importance of the script; analyzes the impact degree on other scripts when the nodes of special concern fail, conducts a risk assessment on all scripts, and divides the scripts into several risk levels according to the overall risk index; The real-time monitoring and dynamic risk assessment module obtains all scripts and their data flow paths in the data center in real time, identifies the real-time nodes of special concern according to the data obtained in real time, conducts a risk assessment on all current scripts, and thus obtains the risk levels of all current scripts; The warning information generation module generates corresponding warning information according to the results of risk assessment and real-time monitoring, and stores the real-time risk levels of the real-time nodes of special concern and the newly added scripts.

7. A data center security monitoring data management system according to claim 6, characterized in that: The script scanning and script dataset construction module includes a script scanning unit, a data flow path identification unit, and a data flow diagram construction unit; The script scanning unit scans all scripts in the data center, identifies and collects the information of each script, and generates a script set and a data flow path set; the data flow path identification unit is used to identify the data flow path of each script; the data flow diagram construction unit draws a data flow diagram based on the scripts and their data flow paths, corresponds each script with the corresponding data flow diagram, and forms a script dataset; The script dependency analysis module includes an input / output information extraction unit, a script dependency graph construction unit, and an importance evaluation unit; The input / output information extraction unit extracts the input information and output information of each script from the data flow diagram, and identifies all input nodes and output nodes; the script dependency graph construction unit constructs a dependency graph between scripts based on the extracted input and output information; The importance evaluation unit calculates the in-degree, out-degree, and betweenness centrality of each script, and comprehensively evaluates the importance of each script in the dependency graph to obtain an importance index.

8. The data center security monitoring data management system according to claim 6, characterized in that: The risk assessment module includes a special concern node identification unit, an impact degree calculation unit, and an overall risk assessment unit; The special concern node identification unit identifies and marks the nodes of special concern based on the script dependency graph and the importance evaluation result; The influence degree calculation unit calculates the influence degree on other scripts when a node of special concern fails, and calculates the total influence value of each script; the overall risk assessment unit calculates the overall risk index of each script based on the nodes of special concern and the influence degree, and divides all scripts into risk levels according to the overall risk index.

9. A data center security monitoring data management system according to claim 6, characterized in that: The real-time monitoring and dynamic risk assessment module includes a real-time data acquisition unit, a real-time special concern node identification unit, and a real-time risk assessment unit; The real-time data acquisition unit regularly obtains all scripts in the data center and their data flow paths, and constructs a real-time script data set and a script dependency graph; The real-time special concern node identification unit identifies the nodes of special concern in the current data flow graph according to the real-time data; The real-time risk assessment unit evaluates the risk levels of all current scripts according to the real-time script data set and the dependency graph; The early warning information generation module includes a new script risk assessment unit, a risk level change monitoring unit, and an early warning information generation unit; The new script risk assessment unit calculates the risk level of the newly added script and generates a corresponding risk assessment list; the risk level change monitoring unit monitors the change of the risk level of the script, judges whether the current risk level has increased, and generates early warning information if there is an increase; The early warning information generation unit generates early warning information according to the risk assessment result of the risk level change monitoring unit and pushes it to relevant personnel.

Images