System operation risk prevention and control method, system and equipment based on special data area and medium

Abstract

The invention discloses a system operation risk prevention and control method, system and equipment based on a special data area and a medium. The method comprises the following steps: collecting and preprocessing user historical operation data of the special data area; mapping the historical operation data of the user into a time window according to a set time step length; arranging the mapped user historical operation data according to a time ascending order, and generating a user operation behavior intermediate table; performing risk identification on the user historical operation data in the user operation behavior intermediate table by using an ADTK anomaly detection algorithm; scoring the user behavior, wherein scoring indexes comprise the first login time of the user account, the total number of abnormal operations in nearly three months, the abnormal operation proportion and the number of historical login IPs in nearly three months; dividing risk levels of the user behaviors based on the user behavior scores; and performing early warning on the user behavior according to the risk level. The system can give an alarm to related personnel in time, so that the related personnel can take proper measures to solve problems, and the stability and usability of the system are guaranteed.

Description

Technical Field

[0001] The present invention belongs to the field of software system risk prevention and control, and specifically relates to a system operation risk prevention and control method, system, equipment and medium based on a data zone. Background Art

[0002] Data zones refer to areas within government departments where data fusion applications are developed for specific application scenarios. Government software systems often encounter various risks and problems during operation, such as system crashes, network anomalies, user behavior risks, etc. These problems can cause huge economic and reputational losses to the government. Therefore, how to improve the stability and reliability of government software systems has become an urgent issue to be solved.

[0003] Existing system operation risk prevention and control usually conducts early warning and judgment from several aspects such as system resource consumption, application errors, network connection status and user behavior risks.

[0004] However, the existing system operation risk prevention and control still has the following problems:

[0005] Insufficient accuracy of risk prevention and control (false positives and false negatives): Sometimes, false warnings may be issued because the system’s algorithm is flawed or because the system does not correctly identify risks.

[0006] The system’s risk identification response time is too long: In some cases, the early warning system may issue an early warning only after the risk has occurred, at which point it may be too late to take countermeasures.

[0007] Insufficient coverage of risk identification: Some warnings can only cover a portion of operations, and may not be able to provide warnings for some uncommon operations.

[0008] Insufficient maintainability and scalability of risk identification: As software systems continue to upgrade and expand, algorithms may need to be continuously upgraded and optimized to adapt to new operational risks. However, some early warning algorithms may lack maintainability and scalability and cannot meet this demand. Summary of the invention

[0009] The present invention aims at the deficiencies in the prior art and provides a method, system, device and medium for system operation risk prevention and control based on data zone, which improves the accuracy of risk prevention and control of data zone system by introducing new indicators, data preprocessing, cross-validation and other methods. It improves the timeliness of risk prevention and control warning and processing by real-time data cleaning, dynamic adjustment of thresholds and automatic early warning and other methods. It improves the accuracy and timeliness of risk prevention and control.

[0010] To achieve the above object, the present invention adopts the following technical solutions:

[0011] A system operation risk prevention and control method based on a data zone, wherein the operation data generated by user behavior is stored in the data zone, comprising the following steps:

[0012] Collect historical user operation data in the data area;

[0013] Preprocess the user's historical operation data;

[0014] Map the user's historical operation data into a time window according to the set time step, and the width of the time window is equal to the time step; sort the mapped user's historical operation data in ascending order of time to generate an intermediate table of user operation behaviors;

[0015] Use the ADTK anomaly detection algorithm to identify risks in the user's historical operation data in the user operation behavior intermediate table to mark abnormal user operations;

[0016] Scoring user behavior, with scoring indicators including the first login time of the user account, the total number of abnormal operations in the past three months, the proportion of abnormal operations, and the number of historical login IP addresses in the past three months;

[0017] Divide user behavior risk levels based on user behavior scores; issue warnings for user behavior based on risk levels.

[0018] To optimize the above technical solutions, the specific measures taken also include:

[0019] Furthermore, the user historical operation data includes system identification, user ID, account login IP and operation time;

[0020] The preprocessing of the user's historical operation data includes:

[0021] Eliminate data that is missing necessary fields, including system identification and operation time, and eliminate duplicate data;

[0022] Standardize the data format and uniformly adjust the operation time format to "yyyy-mm-dd hh:mm:ss" through the timestamp method; yyyy represents year, mm represents month, dd represents day, hh represents hour, mm represents minute, and ss represents second.

[0023] Furthermore, the specific process of using the ADTK anomaly detection algorithm to identify the risk of the user's historical operation data in the user operation behavior intermediate table is as follows:

[0024] Sliding time window, performing feature statistics on the user's historical operation data in the time window in turn, and outputting the skewed distribution of the user's historical operation data in each time window;

[0025] Set the abnormal data determination threshold according to the skewed distribution; the formula is as follows:

[0026] λ=Q3+C×IQR

[0027] In the formula, λ represents the abnormal data judgment threshold, Q3 represents the upper quartile, C represents the adjustment coefficient, which is set according to the skewed distribution, and IQR represents the difference between 75% of the upper quartile and 25% of the lower quartile;

[0028] If the user's historical operation data exceeds the abnormal data determination threshold, it is determined to be abnormal data, and the user behavior that generates the abnormal data is marked as an abnormal user operation.

[0029] Furthermore, the scoring of user behavior is specifically as follows:

[0030] Set the scoring interval and score for the first login time of the user account, specifically: if the first login time is within the interval [0, 1 month), the score is 4 points; if the first login time is within the interval [1 month, 3 months), the score is 3 points; if the first login time is within the interval [3 months, 6 months), the score is 2 points; if the first login time is within the interval [6 months, +∞), the score is 1 point;

[0031] Set the scoring range and score for the total number of abnormal operations in the past three months. Specifically, if the total number of abnormal operations in the past three months is within the interval [0, 3), the score is 1 point; if the total number of abnormal operations in the past three months is within the interval [3, 10), the score is 2 points; if the total number of abnormal operations in the past three months is within the interval [10, 20), the score is 3 points; if the total number of abnormal operations in the past three months is within the interval [20, +∞), the score is 5 points;

[0032] Set the scoring interval and score for the abnormal operation ratio, specifically: if the abnormal operation ratio is within the interval [0, 20%), the score is 1 point; if the abnormal operation ratio is within the interval [20%, 40%), the score is 2 points; if the abnormal operation ratio is within the interval [40%, 60%), the score is 3 points; if the abnormal operation ratio is within the interval [60%, 80%), the score is 4 points; if the abnormal operation ratio is within the interval [80%, 100%), the score is 5 points;

[0033] Set the scoring range and score for the number of historical login IP addresses in the past three months. Specifically, if the number of historical login IP addresses in the past three months is in the range [0, 3), the score is 1 point; if the number of historical login IP addresses in the past three months is in the range [3, +∞), the score is 3 points.

[0034] The user behavior score is calculated according to the following formula:

[0035] User behavior score = scoring indicator weight × scoring indicator score.

[0036] Furthermore, the risk level of user behavior divided based on user behavior score is specifically:

[0037] If the user behavior score is in the range [0, 8), the risk level is no risk; if the user behavior score is in the range [8, 30), the risk level is potential risk; if the user behavior score is in the range [30, 55), the risk level is low risk; if the user behavior score is in the range [55, 80), the risk level is medium risk; if the user behavior score is in the range [80, 100], the risk level is high risk.

[0038] The present invention also proposes a system operation risk prevention and control system based on a data zone, in which the operation data generated by user behavior is stored in the data zone, including:

[0039] Data collection module, used to collect historical user operation data in the data zone;

[0040] Data preprocessing module, used to preprocess user historical operation data;

[0041] The user operation behavior intermediate table generation module is used to map the user's historical operation data into a time window according to the set time step, and the time window width is equal to the time step; the mapped user's historical operation data is arranged in ascending time order to generate the user operation behavior intermediate table;

[0042] The risk identification module is used to use the ADTK anomaly detection algorithm to identify the risks of the user's historical operation data in the user operation behavior intermediate table to mark abnormal user operations;

[0043] Scoring module, used to score user behavior. Scoring indicators include the first login time of the user account, the total number of abnormal operations in the past three months, the proportion of abnormal operations, and the number of historical login IP addresses in the past three months;

[0044] The early warning module is used to classify the risk level of user behavior based on the user behavior score; and to issue early warnings to user behavior according to the risk level.

[0045] The present invention also proposes an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the system operation risk prevention and control method based on a data zone as described above is implemented.

[0046] The present invention also proposes a computer-readable storage medium storing a computer program, wherein the computer program enables a computer to execute the system operation risk prevention and control method based on a data zone as described above.

[0047] The beneficial effects of the present invention are:

[0048] The present invention predicts and identifies the risks that may occur during the operation of the data zone, so as to take timely countermeasures to avoid or reduce the impact on the normal operation of the data zone. The risk prevention and control algorithm monitors the operating status and related indicators of the data zone in real time, promptly discovers abnormalities and potential risk problems, and promptly issues alarms to relevant personnel so that they can take appropriate measures to solve the problems and ensure the stability and availability of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 This is a flow chart of the system operation risk prevention and control method based on data zone proposed by the present invention.

[0050] Figure 2 This is a skewed distribution diagram of the user's historical operation data.

[0051] Figure 3 This is the adjusted normal user historical operation data range. DETAILED DESCRIPTION

[0052] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0053] Embodiment 1

[0054] The present invention proposes a system operation risk prevention and control method based on a data zone. The operation data generated by user behavior is stored in the data zone. The process of the method is as follows: Figure 1 As shown, the following steps are included:

[0055] Collect user historical operation data in the data area; user historical operation data includes system identification, user ID, account login IP and operation time;

[0056] Preprocess the user's historical operation data; including:

[0057] Eliminate data that is missing necessary fields, including system identification and operation time, and eliminate duplicate data;

[0058] Standardize the data format and uniformly adjust the operation time format to "yyyy-mm-dd hh:mm:ss" through the timestamp method; yyyy represents year, mm represents month, dd represents day, hh represents hour, mm represents minute, and ss represents second.

[0059] Map the user's historical operation data to a time window according to the set time step, and the time window width is equal to the time step; the time step in this embodiment is 10 minutes. Arrange the mapped user's historical operation data in ascending time order to generate an intermediate table of user operation behaviors;

[0060] The user operation behavior intermediate table of this embodiment is as follows:

[0061]

[0062] In the table, m0 is a multiple of 10, indicating that the width of a single time window is 10 minutes.

[0063] Using the ADTK anomaly detection algorithm, the user's historical operation data in the user operation behavior intermediate table is marked for risk to mark abnormal user operations; the specific process is as follows:

[0064] Slide the time window, perform feature statistics on the user's historical operation data in the time window in turn, and output the skewed distribution of the user's historical operation data in each time window; the skewed distribution diagram of the user's historical operation data is as follows Figure 2 shown.

[0065] Set the abnormal data determination threshold according to the skewed distribution; the formula is as follows:

[0066] λ=Q3+C×IQR

[0067] In the formula, λ represents the abnormal data judgment threshold, Q3 represents the upper quartile, C represents the adjustment coefficient, which is set according to the skewed distribution, and IQR represents the difference between 75% of the upper quartile and 25% of the lower quartile;

[0068] Taking C=1 as an example, the adjusted normal user historical operation data range is as follows: Figure 3 .

[0069] If the user's historical operation data exceeds the abnormal data determination threshold, it is determined to be abnormal data, and the user behavior that generates the abnormal data is marked as abnormal user operation. A risk indicator of 0 indicates a normal user operation, and a risk indicator of 1 indicates an abnormal user operation.

[0070]

[0071] Scoring of user behavior, with scoring indicators including the first login time of the user account, the total number of abnormal operations in the past three months, the proportion of abnormal operations, and the number of historical login IP addresses in the past three months; the specific scoring of user behavior is as follows:

[0072] Set the scoring range and score value for the first login time of the user account, specifically: if the first login time is within the interval [0, 1 month), the score is 4 points; if the first login time is within the interval [1 month, 3 months), the score is 3 points; if the first login time is within the interval [3 months, 6 months), the score is 2 points; if the first login time is within the interval [6 months, +∞), the score is 1 point.

[0073] The time interval for assigning points to the account's first login Index score (unit: points) [0, 1 month) 4 [1 month, 3 months) 3 [3 months, 6 months) 2 [6 months, +∞) 1

[0074] Set the scoring range and score for the total number of abnormal operations in the past three months. Specifically, if the total number of abnormal operations in the past three months is in the interval [0, 3), the score is 1 point; if the total number of abnormal operations in the past three months is in the interval [3, 10), the score is 2 points; if the total number of abnormal operations in the past three months is in the interval [10, 20), the score is 3 points; if the total number of abnormal operations in the past three months is in the interval [20, +∞), the score is 5 points.

[0075] Scoring interval for the number of abnormal operations in the past three months Index score (unit: points) [0，3) 1 [3，10) 2 [10，20) 3 [20，+∞) 5

[0076] Set the scoring range and score for the abnormal operation ratio, specifically: if the abnormal operation ratio is in the interval [0, 20%), the score is 1 point; if the abnormal operation ratio is in the interval [20%, 40%), the score is 2 points; if the abnormal operation ratio is in the interval [40%, 60%), the score is 3 points; if the abnormal operation ratio is in the interval [60%, 80%), the score is 4 points; if the abnormal operation ratio is in the interval [80%, 100%), the score is 5 points.

[0077] Abnormal operation ratio scoring interval Index score (unit: points) [0，20％) 1 [20％，40％) 2 [40％，60％) 3 [60％，80％) 4 [80％，100％] 5

[0078] Set the scoring range and score for the number of historical login IP addresses in the past three months. Specifically, if the number of historical login IP addresses in the past three months is in the range [0, 3), the score is 1 point; if the number of historical login IP addresses in the past three months is in the range [3, +∞), the score is 3 points.

[0079]

[0080]

[0081] The user behavior score is calculated according to the following formula:

[0082] User behavior score = scoring indicator weight × scoring indicator score.

[0083] In this embodiment, the scoring index weights are set as follows:

[0084] The weight of the first login time of the account is 1, the weight of the total number of abnormal operations in the past three months is 10, the weight of the abnormal operation ratio is 5, and the weight of the number of historical login IPs in the past three months is 7.

[0085] An example of the calculation formula for user behavior score is as follows: User ID: User; Account first login time: 2 months ago; Total number of abnormal operations in the past 3 months: 5 times; Percentage of abnormal operations: 25%; Number of historical login IP addresses in the past 3 months: 2. The user behavior score example is as follows:

[0086]

[0087] The risk level of user behavior is divided based on the user behavior score; the risk level is set as follows:

[0088] User behavior score Risk Level [0，8) No risk [8，30) Potential risks [30，55) Low risk [55，80) Medium risk [80，100] High risk

[0089] The risk prevention and control model of the present invention is applied to the operation process of the data zone system in the form of a component, and the user behavior is warned according to the risk level, and warning information such as system name, user account / ID, operation time, abnormality and risk level are output;

[0090]

[0091] Automated early warning processing is carried out for high-risk events, relevant high-risk accounts are temporarily locked, and relevant information is pushed to system administrators for processing; risk identification algorithms are regularly tested and evaluated to continuously optimize and improve the accuracy and timeliness of early warnings.

[0092] Embodiment 2

[0093] The present invention proposes a system operation risk prevention and control system based on a data zone corresponding to the method of the first embodiment, wherein the operation data generated by user behavior is stored in the data zone, and the system includes:

[0094] Data collection module, used to collect historical user operation data in the data zone;

[0095] Data preprocessing module, used to preprocess user historical operation data;

[0096] The user operation behavior intermediate table generation module is used to map the user's historical operation data into a time window according to the set time step, and the time window width is equal to the time step; the mapped user's historical operation data is arranged in ascending time order to generate the user operation behavior intermediate table;

[0097] The risk identification module is used to use the ADTK anomaly detection algorithm to identify the risks of the user's historical operation data in the user operation behavior intermediate table to mark abnormal user operations;

[0098] Scoring module, used to score user behavior. Scoring indicators include the first login time of the user account, the total number of abnormal operations in the past three months, the proportion of abnormal operations, and the number of historical login IP addresses in the past three months;

[0099] The early warning module is used to classify the risk level of user behavior based on the user behavior score; and to issue early warnings to user behavior according to the risk level.

[0100] The implementation methods of each module and module function in the system are completely consistent with the steps of the method in Example 1, so they will not be repeated here.

[0101] Embodiment 3

[0102] The present invention proposes an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the system operation risk prevention and control method based on a data zone as described in Example 1 is implemented.

[0103] Embodiment 4

[0104] The present invention proposes a computer-readable storage medium storing a computer program, wherein the computer program enables a computer to execute the system operation risk prevention and control method based on a data zone as described in Example 1.

[0105] In the embodiments disclosed in the present application, the computer storage medium can be a tangible medium that can contain or store a program for use by or in conjunction with an instruction execution system, device or equipment. The computer storage medium can include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the above. More specific examples of computer storage media can include electrical connections based on one or more lines, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the above.

[0106] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed in this application can be implemented in electronic hardware or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0107] The above are only preferred embodiments of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technicians in this technical field, some improvements and modifications without departing from the principle of the present invention should be regarded as the protection scope of the present invention.

Claims

1. A system operation risk prevention and control method based on a data zone, wherein the operation data generated by user behavior is stored in the data zone, characterized in that: The following steps are involved: Collect historical user operation data in the data area; Preprocess the user's historical operation data; Map the user's historical operation data into a time window according to the set time step, and the width of the time window is equal to the time step; Arrange the mapped user historical operation data in ascending time order to generate an intermediate table of user operation behavior; Use the ADTK anomaly detection algorithm to identify risks in the user's historical operation data in the user operation behavior intermediate table to mark abnormal user operations; Scoring user behavior, with scoring indicators including the first login time of the user account, the total number of abnormal operations in the past three months, the proportion of abnormal operations, and the number of historical login IP addresses in the past three months; Classify the risk level of user behavior based on user behavior scores; Provide early warnings for user behavior based on risk levels.

2. The system operation risk prevention and control method based on the data zone according to claim 1, characterized in that: The user's historical operation data includes system identification, user ID, account login IP and operation time; The preprocessing of the user's historical operation data includes: Eliminate data that is missing necessary fields, including system identification and operation time, and eliminate duplicate data; Standardize the data format and uniformly adjust the operation time format to "yyyy-mm-dd hh:mm:ss" through the timestamp method; yyyy represents year, mm represents month, dd represents day, hh represents hour, mm represents minute, and ss represents second.

3. The method for preventing and controlling system operation risks based on a data zone according to claim 1, characterized in that: The specific process of using the ADTK anomaly detection algorithm to identify the risk of user historical operation data in the user operation behavior intermediate table is as follows: Sliding time window, performing feature statistics on the user's historical operation data in the time window in turn, and outputting the skewed distribution of the user's historical operation data in each time window; Set the abnormal data determination threshold according to the skewed distribution; the formula is as follows: λ =Q3+C×IQR In the formula, λ represents the abnormal data judgment threshold, Q3 represents the upper quartile, C represents the adjustment coefficient, which is set according to the skewed distribution, and IQR represents the difference between the 75% of the upper quartile and the 25% of the lower quartile; If the user's historical operation data exceeds the abnormal data determination threshold, it is determined to be abnormal data, and the user behavior that generates the abnormal data is marked as an abnormal user operation.

4. The system operation risk prevention and control method based on the data zone according to claim 1, characterized in that: The user behavior scoring is specifically as follows: Set the scoring interval and score value for the first login time of the user account, specifically: if the first login time is within the interval [0, 1 month), the score is 4 points; if the first login time is within the interval [1 month, 3 months), the score is 3 points; if the first login time is within the interval [3 months, 6 months), the score is 2 points; if the first login time is within the interval [6 months, +∞), the score is 1 point; Set the scoring range and score for the total number of abnormal operations in the past three months. Specifically, if the total number of abnormal operations in the past three months is within the interval [0, 3), the score is 1 point; if the total number of abnormal operations in the past three months is within the interval [3, 10), the score is 2 points; if the total number of abnormal operations in the past three months is within the interval [10, 20), the score is 3 points; if the total number of abnormal operations in the past three months is within the interval [20, +∞), the score is 5 points; Set the scoring range and score for the abnormal operation ratio. Specifically, if the abnormal operation ratio is within the range [0, 20%), the score is 1 point; if the abnormal operation ratio is within the range [20%, 40%), the score is 2 points; if the abnormal operation ratio is within the range [40%, 60%), the score is 3 points; if the abnormal operation ratio is within the range [60%, 80%), the score is 4 points; if the abnormal operation ratio is within the range [80%, 100%), the score is 5 points; Set the scoring range and score for the number of historical login IP addresses in the past three months. Specifically, if the number of historical login IP addresses in the past three months is in the range [0, 3), the score is 1 point; if the number of historical login IP addresses in the past three months is in the range [3, +∞), the score is 3 points. The user behavior score is calculated according to the following formula: User behavior score = scoring indicator weight × scoring indicator score.

5. The method for preventing and controlling system operation risks based on a data zone according to claim 1, characterized in that: The risk level of user behavior divided based on user behavior score is specifically: If the user behavior score is in the interval [0, 8), the risk level is no risk; if the user behavior score is in the interval [8, 30), the risk level is potential risk; if the user behavior score is in the interval [30, 55), the risk level is low risk; if the user behavior score is in the interval [55, 80), the risk level is medium risk; if the user behavior score is in the interval [80, 100], the risk level is high risk.

6. A system operation risk prevention and control system based on a data zone, in which the operation data generated by user behavior is stored in the data zone, characterized in that: include: Data collection module, used to collect historical user operation data in the data zone; Data preprocessing module, used to preprocess user historical operation data; The user operation behavior intermediate table generation module is used to map the user's historical operation data into a time window according to the set time step, and the time window width is equal to the time step; Arrange the mapped user historical operation data in ascending time order to generate an intermediate table of user operation behavior; The risk identification module is used to use the ADTK anomaly detection algorithm to identify the risks of the user's historical operation data in the user operation behavior intermediate table to mark abnormal user operations; Scoring module, used to score user behavior. Scoring indicators include the first login time of the user account, the total number of abnormal operations in the past three months, the proportion of abnormal operations, and the number of historical login IP addresses in the past three months; An early warning module is used to classify the risk level of user behavior based on the user behavior score; Provide early warnings for user behavior based on risk levels.

7. An electronic device, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the method for preventing and controlling system operation risks based on a data zone as described in any one of claims 1 to 5 is implemented.

8. A computer-readable storage medium storing a computer program, characterized in that: The computer program enables the computer to execute the system operation risk prevention and control method based on the data zone as described in any one of claims 1-5.

Images