Abnormal operation detection method and device of server, equipment and storage medium

Abstract

The invention relates to an abnormal operation detection method and device of a server, equipment and a storage medium. The method comprises the following steps: acquiring first feature information and second feature information of a server; the first feature information is user feature information of the target user, and the second feature information is feature information of an operation instance in the server; and performing abnormal operation detection on the server according to the first feature information and the second feature information to obtain a detection result. In the data acquisition process, acquisition is carried out from two dimensions, the matching degree of the first feature information and the second feature information with each operation in the server is improved, each operation in the server is also analyzed from two dimensions in the data analysis process, the detection accuracy is improved, and compared with a single-view-angle detection method, the detection efficiency is improved. The double-view-angle model can capture finer abnormal features, the false alarm rate is effectively reduced, and the overall safety of the system is ensured.

Description

Technical Field

[0001] The present application relates to the field of server technology, and in particular to a method, device, equipment and storage medium for detecting abnormal operation of a server. Background Art

[0002] In the modern cloud computing environment, bare metal servers have become the key infrastructure for various computing-intensive businesses due to their excellent performance and direct control over the underlying hardware. The operation of bare metal servers directly affects the stability and security of the underlying hardware. Therefore, it is particularly important to detect the security status of bare metal servers.

[0003] In traditional technologies, bare metal servers are usually managed by determining parameter values ​​corresponding to each operation in the server, and determining whether the parameter values ​​corresponding to each operation are within a normal range based on rules or thresholds to detect abnormalities in each operation in the server.

[0004] However, traditional abnormal operation detection methods suffer from low detection accuracy. Summary of the invention

[0005] Based on this, it is necessary to provide a method, device, equipment and storage medium for detecting abnormal operation of a server that can improve detection accuracy in response to the above technical problems.

[0006] In a first aspect, the present application provides a method for detecting abnormal operation of a server, comprising:

[0007] Acquire first characteristic information and second characteristic information of the server; the first characteristic information is user characteristic information of a target user, and the second characteristic information is characteristic information of an operation instance in the server;

[0008] An abnormal operation detection is performed on the server according to the first characteristic information and the second characteristic information to obtain a detection result.

[0009] In one embodiment, performing abnormal operation detection on the server according to the first characteristic information and the second characteristic information to obtain a detection result includes:

[0010] Inputting the first feature information into a pre-trained first detection model to perform abnormal operation detection to obtain a first detection result;

[0011] Inputting the second feature information into a pre-trained second detection model to perform abnormal operation detection to obtain a second detection result;

[0012] The detection result is determined according to the first detection result and the second detection result.

[0013] In one embodiment, determining the detection result according to the first detection result and the second detection result includes:

[0014] Determine a total abnormality prediction score corresponding to each operation according to a first abnormality prediction score corresponding to each operation in the first detection result and a second abnormality prediction score corresponding to each operation in the second detection result;

[0015] The detection result is determined according to the total abnormality prediction score corresponding to each of the operations and a preset score threshold.

[0016] In one embodiment, determining a total abnormality prediction score corresponding to each operation according to a first abnormality prediction score corresponding to each operation in the first detection result and a second abnormality prediction score corresponding to each operation in the second detection result includes:

[0017] Determine a first score mean and a first standard deviation based on all first anomaly prediction scores in the first detection result; and determine a second score mean and a second standard deviation based on all second anomaly prediction scores in the second detection result;

[0018] Determine a first prediction score for each of the operations according to each first abnormality prediction score in the first detection result, the first score mean, and the first standard deviation; and determine a second prediction score for each of the operations according to each second abnormality prediction score in the second detection result, the second score mean, and the second standard deviation;

[0019] According to the first prediction score of each operation, the second prediction score of each operation, the preset first weight and the preset second weight, a total abnormality prediction score corresponding to each operation is determined.

[0020] In one embodiment, the method further comprises:

[0021] Determining the actual abnormal operation of the server;

[0022] Determining a detection accuracy rate of the detection result according to the actual abnormal operation situation, the first detection result, and the second detection result;

[0023] The first weight and the second weight are updated according to the detection readiness rate, and the first weight is replaced by the updated first weight, and the second weight is replaced by the updated second weight.

[0024] In one embodiment, the training process of the first detection model and the second detection model includes:

[0025] Acquire first historical feature information and second historical feature information of the server;

[0026] Training a first initial isolation forest model according to the first historical feature information to obtain the first detection model;

[0027] The second initial isolation forest model is trained according to the second historical feature information to obtain the second detection model.

[0028] In one embodiment, the method further comprises:

[0029] Determining a risk level of the server according to the detection result;

[0030] According to the risk level and preset processing logic, potential abnormal operation processing is performed on the server; the preset processing logic includes abnormal operation strategies corresponding to different risk levels.

[0031] In a second aspect, the present application also provides a device for detecting abnormal operation of a server, comprising:

[0032] An acquisition module, used to acquire first characteristic information and second characteristic information of the server; the first characteristic information is user characteristic information of a target user, and the second characteristic information is characteristic information of an operation instance in the server;

[0033] A detection module is used to perform abnormal operation detection on the server according to the first characteristic information and the second characteristic information to obtain a detection result.

[0034] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0035] Acquire first characteristic information and second characteristic information of the server; the first characteristic information is user characteristic information of a target user, and the second characteristic information is characteristic information of an operation instance in the server;

[0036] An abnormal operation detection is performed on the server according to the first characteristic information and the second characteristic information to obtain a detection result.

[0037] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0038] Acquire first characteristic information and second characteristic information of the server; the first characteristic information is user characteristic information of a target user, and the second characteristic information is characteristic information of an operation instance in the server;

[0039] An abnormal operation detection is performed on the server according to the first characteristic information and the second characteristic information to obtain a detection result.

[0040] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0041] Acquire first characteristic information and second characteristic information of the server; the first characteristic information is user characteristic information of a target user, and the second characteristic information is characteristic information of an operation instance in the server;

[0042] An abnormal operation detection is performed on the server according to the first characteristic information and the second characteristic information to obtain a detection result.

[0043] The above-mentioned abnormal operation detection method, device, equipment and storage medium of the server obtain the first characteristic information and the second characteristic information of the server; the first characteristic information is the user characteristic information of the target user, and the second characteristic information is the characteristic information of the operation instance in the server; the server is detected for abnormal operation according to the first characteristic information and the second characteristic information to obtain the detection result. In the process of data acquisition, the data is acquired from two dimensions, which improves the matching degree between the first characteristic information and the second characteristic information and each operation in the server, and in the process of data analysis, each operation in the server is also analyzed from two dimensions, which improves the detection accuracy. Compared with the single-view detection method, the dual-view model can capture more subtle abnormal features, effectively reduce the false alarm rate, and ensure the overall security of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0045] FIG1 is an application environment diagram of a method for detecting abnormal operation of a server in one embodiment;

[0046] Figure 2 The figure is a flow chart of a method for detecting abnormal operation of a server in one embodiment;

[0047] Figure 3 It is a flowchart of a method for detecting abnormal operation of a server in another embodiment;

[0048] Figure 4It is a flowchart of a method for detecting abnormal operation of a server in another embodiment;

[0049] Figure 5 It is a flowchart of a method for detecting abnormal operation of a server in another embodiment;

[0050] Figure 6 It is a flowchart of a method for detecting abnormal operation of a server in another embodiment;

[0051] Figure 7 It is a flowchart of a method for detecting abnormal operation of a server in another embodiment;

[0052] Figure 8 It is a flowchart of a method for detecting abnormal operation of a server in another embodiment;

[0053] Fig. 9 It is a flowchart of a method for detecting abnormal operation of a server in another embodiment;

[0054] Fig.10 The figure is a structural block diagram of an abnormal operation detection device of a server in one embodiment. DETAILED DESCRIPTION

[0055] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0056] In the modern cloud computing environment, bare metal servers have become the key infrastructure for various computing-intensive businesses with their excellent performance and direct control over the underlying hardware. Unlike virtualized servers, the operation of bare metal servers directly affects the stability and security of the underlying hardware, so it is particularly important to manage the security of these servers.

[0057] Currently, the management of most bare metal servers relies on traditional monitoring tools, which usually detect abnormal user behavior based on rules or thresholds. However, with the expansion of cloud computing and the diversification of user operations, traditional methods have gradually shown their limitations when dealing with massive amounts of data. Specifically, they are difficult to detect abnormal behavior in real time, unable to effectively identify complex abnormal patterns, and have high false alarm rates. These problems are particularly prominent when facing frequent resource calls, configuration changes, and high concurrent operations.

[0058] Based on this, the present application proposes a method for detecting abnormal operation of a server.

[0059] The abnormal operation detection method of the server provided in the embodiment of the present application can be applied to the application environment as shown in Figure 1. Wherein, the computer device can be a server, and its internal structure diagram can be shown in Figure 1. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Wherein, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Wherein, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store abnormal operation detection data of the server. The input / output interface of the computer device is used to exchange information between the processor and the external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a method for detecting abnormal operation of a server is implemented.

[0060] Those skilled in the art will understand that the structure shown in FIG. 1 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0061] In one embodiment, Figure 2 As shown, a method for detecting abnormal operation of a server is provided, and the method is applied to the server in FIG1 as an example for description, including:

[0062] S201, obtaining first characteristic information and second characteristic information of a server; the first characteristic information is user characteristic information of a target user, and the second characteristic information is characteristic information of an operation instance in the server.

[0063] The first characteristic information includes user name, user identification information, user type, cumulative number of user operations, creation time, update time, etc. The second characteristic information includes server operation data and instance data. The server operation data includes attribute information such as operation instance creation time, host name, specification type, whether it is elastic bare metal, whether it supports cloud disk, etc. The instance data includes device identification information, operation instance identification, operation type, operation name, operation instance status, number of retries, execution time, update time, etc. The device identification information may include the device serial number, i.e., the device SN number, and the device identification information may also include the device identifier, i.e., the device ID number.

[0064] In the embodiment of the present application, the user operation log, user information and instance information of the server are obtained, and the above data are stored in the database. Optionally, the user operation log, user information and instance information can be collected by a preset data collection component; or, the server can obtain the user operation log, user information and instance information of the server by interacting with a third-party platform, and further, the obtained data is cleaned to clean invalid values, missing values ​​and duplicate records in the data, and the instance operation data is associated with the user data through the operation instance identifier, and divided into user data and instance data.

[0065] In the embodiment of the present application, after determining the user data and instance data, the user data and instance data are preprocessed to remove useless data columns, extract time features and behavior features, and convert the time features and behavior features into numerical form. Optionally, the creation time and execution time can be converted into timestamps, and the difference can be calculated to obtain the operation time; non-numeric data such as instance operation type and state type are uniquely encoded and converted into data that the model can receive; other discrete values ​​are numerically normalized.

[0066] It should be noted that the server can be a bare metal server (BMS), which is a device that combines the functions of a physical server and cloud computing virtualization services. It provides dedicated computing resources such as CPU, memory, storage and network resources without the performance overhead of the virtualization layer, thereby ensuring high performance and data security.

[0067] S202: Perform abnormal operation detection on the server according to the first characteristic information and the second characteristic information to obtain a detection result.

[0068] In the embodiment of the present application, abnormal operation detection is performed based on the first feature information, the second feature information and a pre-trained detection model. Optionally, the first feature information and the second feature information can be sequentially input into the detection model, and the output result of the detection model is used as the detection result of abnormal operation detection on the server.

[0069] In the above-mentioned abnormal operation detection method of the server, the first characteristic information and the second characteristic information of the server are obtained; the first characteristic information is the user characteristic information of the target user, and the second characteristic information is the characteristic information of the operation instance in the server; the abnormal operation detection of the server is performed according to the first characteristic information and the second characteristic information to obtain the detection result. In the process of data acquisition, the data is acquired from two dimensions, which improves the matching degree between the first characteristic information and the second characteristic information and each operation in the server, and in the process of data analysis, each operation in the server is analyzed from two dimensions, which improves the detection accuracy. Compared with the single-view detection method, the dual-view model can capture more subtle abnormal features, effectively reduce the false alarm rate, and ensure the overall security of the system.

[0070] In one embodiment, an implementation of the above S202 is provided, such as Figure 3 As shown, the above “performing abnormal operation detection on the server according to the first characteristic information and the second characteristic information to obtain a detection result” includes:

[0071] S301, inputting the first feature information into a pre-trained first detection model to perform abnormal operation detection to obtain a first detection result.

[0072] The first detection model is obtained by pre-training an initial detection model according to first historical feature information, and the first historical feature information is historical user feature information.

[0073] In the embodiment of the present application, the first characteristic information can be expressed as , where i is the i-th operation in the server, the first feature information is input into the first detection model, and the first detection model is Process and obtain The corresponding anomaly prediction score .

[0074] S302: Input the second feature information into a pre-trained second detection model to perform abnormal operation detection to obtain a second detection result.

[0075] The second detection model is obtained by pre-training the initial detection model according to the second historical feature information, and the second feature information is feature information of historical operation instances in the server.

[0076] In the embodiment of the present application, the first characteristic information can be expressed as , where i is the i-th operation in the server, and the second feature information Input into the second detection model, the second detection model Process and obtain The corresponding second anomaly prediction score .

[0077] S303: Determine a detection result according to the first detection result and the second detection result.

[0078] In an embodiment of the present application, for each operation in the server, the abnormal prediction score in the first detection result and the abnormal prediction score in the second detection result are analyzed to determine the detection result. Optionally, if the first detection result is greater than the first preset score, and / or the second detection result is greater than the second preset score, then it is determined that the detection result indicates that the operation is an abnormal operation; if the first detection result is not greater than the first preset score, and / or the second detection result is not greater than the second preset score, then it is determined that the detection result indicates that the operation is not an abnormal operation.

[0079] In the above application embodiment, the first feature information is analyzed by the first detection model. Since the first detection model matches the first feature information and the second detection model matches the second feature information, the accuracy of the first detection result and the second detection result is improved. Furthermore, the first detection result and the second detection result are combined to improve the accuracy of the detection result.

[0080] In one embodiment, an implementation of the above S303 is provided, such as Figure 4 As shown, the above “determining the test result according to the first test result and the second test result” includes:

[0081] S401, determining a total abnormality prediction score corresponding to each operation according to the abnormality prediction score corresponding to each operation in the first detection result and the abnormality prediction score corresponding to each operation in the second detection result.

[0082] In an embodiment of the present application, the first detection result includes a first abnormal prediction score corresponding to each operation in the server, and the second detection result includes a second abnormal prediction score corresponding to each operation in the server. For each operation in the server, the first abnormal prediction score and the second abnormal prediction score are processed to obtain a total abnormal prediction score corresponding to the operation. Optionally, the first preset score and the second preset score may be added to obtain a target prediction score; or, the first preset score and the second preset score may be added and weighted to obtain a target prediction score.

[0083] S402: Determine a detection result according to the total abnormality prediction score corresponding to each operation and a preset score threshold.

[0084] The detection result may include whether each operation is an abnormal operation and the total abnormality prediction score of each operation.

[0085] In an embodiment of the present application, if the total abnormality prediction score is greater than a preset score threshold, it is determined that the detection result indicates that the operation is an abnormal operation; if the total abnormality prediction score is not greater than the preset score threshold, it is determined that the detection result indicates that the operation is not an abnormal operation.

[0086] Optionally, the preset score threshold may include multiple score thresholds. When it is determined that the detection result characterizes that the operation is an abnormal operation, the degree of abnormality of the abnormal operation can be determined based on the total abnormal prediction score and the multiple score thresholds. Optionally, the degree of abnormality may include information level alarm, low risk alarm, medium risk alarm and high risk alarm.

[0087] In the above application embodiment, the first anomaly score and the second anomaly score are combined to improve the accuracy of the total anomaly prediction score. Furthermore, the preset score threshold is used as a reference value and compared with the total anomaly prediction score to improve the accuracy of the detection result.

[0088] In one embodiment, an implementation of the above S401 is provided, such as Figure 5 As shown, the above “determining the total abnormality prediction score corresponding to each operation according to the first abnormality prediction score corresponding to each operation in the first detection result and the second abnormality prediction score corresponding to each operation in the second detection result” includes:

[0089] S501, determining a first score mean and a first standard deviation based on all first anomaly prediction scores in the first detection result; and determining a second score mean and a second standard deviation based on all second anomaly prediction scores in the second detection result.

[0090] In the embodiment of the present application, the first abnormal prediction score is expressed as , i is the i-th operation in the server, the first score mean is the average of all first anomaly prediction scores, and the first score mean is expressed as , the first standard deviation is the standard deviation of all first anomaly prediction scores, and the first standard deviation is expressed as The second anomaly prediction score is expressed as , i is the i-th operation in the server, the second score mean is the average of all second anomaly prediction scores, and the second score mean is expressed as , the second standard deviation is the standard deviation of all second anomaly prediction scores, and the second standard deviation is expressed as .

[0091] S502, determining the first prediction score of each operation based on each first abnormal prediction score, the first score mean and the first standard deviation in the first detection result; and determining the second prediction score of each operation based on each second abnormal prediction score, the second score mean and the second standard deviation in the second detection result.

[0092] In the embodiment of the present application, as shown in Formula 1, the first abnormal prediction score is mean-normalized to obtain the first prediction score, and as shown in Formula 2, the second abnormal prediction score is mean-normalized to obtain the second prediction score:

[0093] (Formula 1)

[0094] (Formula 2)

[0095] in, is the first prediction score, is the second prediction score.

[0096] S503: Determine a total abnormality prediction score corresponding to each operation according to the first prediction score of each operation, the second prediction score of each operation, the preset first weight, and the preset second weight.

[0097] In the embodiment of the present application, the preset first weight can be expressed as , the preset second weight can be expressed as ,and , further, the first prediction score and the second prediction score are weighted and summed according to the first weight and the second weight, as shown in Formula 3:

[0098] (Formula 3)

[0099] Optional, and The initial weight can be set to 0.5, and the weight can be adjusted dynamically according to the model performance during the subsequent model prediction process.

[0100] In the above application embodiment, all first abnormality prediction scores and second abnormality prediction scores are processed according to the preset logic to accurately obtain the first prediction score and the second prediction score. The step-by-step processing is clear and error-prone, thereby improving the accuracy of the total abnormality prediction score corresponding to each operation.

[0101] In one embodiment, Figure 6 As shown, the abnormal operation detection method of the above server also includes:

[0102] S504: Determine the actual abnormal operation status of the server.

[0103] In an embodiment of the present application, the actual abnormal operation of the server can be determined through a pre-configured server monitoring component; or, the actual abnormal operation of the server can be determined based on user input information or received information.

[0104] S505: Determine the detection accuracy of the detection result according to the actual abnormal operation situation, the first detection result and the second detection result.

[0105] In the embodiment of the present application, the actual abnormal operation situation and the detection result are compared, and the number of correct detections of the first detection result is determined according to the operation in the first detection result that is the same as the actual abnormal operation situation, and the number of correct detections of the second detection result is determined according to the operation in the second detection result that is the same as the actual abnormal operation situation, so as to determine the detection accuracy of the detection result according to the number of correct detections and the total number of detections. Optionally, the first detection accuracy is shown in Formula 4, and the second detection accuracy is shown in Formula 5:

[0106] (Formula 4)

[0107] (Formula 5)

[0108] in, is the first detection accuracy, is the first detection model, is the second detection accuracy, It is the second detection model.

[0109] S506, updating the first weight and the second weight according to the detection readiness rate, and replacing the first weight with the updated first weight, and replacing the second weight with the updated second weight.

[0110] In the embodiment of the present application, the first weight and the second weight are dynamically adjusted by exponential moving average (EMA), the adjusted first weight is shown in Formula 5, and the adjusted second weight is shown in Formula 6:

[0111] (Formula 5)

[0112] (Formula 6)

[0113] in, It is a smoothing coefficient, which is generally between 0.1 and 0.3 and is used to control the update weight ratio of the new and old rounds.

[0114] In the above application embodiment, the first weight and the second weight are updated according to the detection readiness rate, which improves the accuracy of the first weight and the second weight, thereby improving the accuracy of the detection result in the next detection process.

[0115] In one embodiment, Figure 7 As shown, the abnormal operation detection method of the above server also includes:

[0116] S203: Acquire first historical feature information and second historical feature information from the server.

[0117] The first historical feature information includes the user name, user identification information, user type, cumulative number of user operations, creation time, update time, etc. corresponding to the historical operation of the server. The second historical feature information includes the historical operation data and historical instance data of the server. The historical operation data of the server includes the creation time, host name, specification type, whether it is elastic bare metal, whether it supports cloud disk, and other attribute information of the operation instance corresponding to the historical operation. The historical instance data includes the device identification information, operation instance identification, operation type, operation name, operation instance status, number of retries, execution time, update time, etc. corresponding to the historical operation. The device identification information may include the device serial number, i.e., the device SN number, and the device identification information may also include the device identifier, i.e., the device ID number.

[0118] In the embodiment of the present application, the user operation log, user information and instance information corresponding to the historical operation of the server are obtained, and the above data are stored in the database. Optionally, the user operation log, user information and instance information can be collected through a preset data collection component; or, the server can obtain the user operation log, user information and instance information of the server by interacting with a third-party platform, and further, the obtained data is cleaned to clean invalid values, missing values ​​and duplicate records in the data, and the instance operation data is associated with the user data through the operation instance identifier, and divided into user data samples And example data samples .

[0119] In the embodiment of the present application, after determining the user data sample and the instance data sample, the user data sample and the instance data sample are preprocessed to remove useless data columns, extract time features and behavior features, and convert the time features and behavior features into numerical form. Optionally, the creation time and execution time can be converted into timestamps, and the difference can be calculated to obtain the operation time; non-numeric data such as instance operation type and state type are uniquely encoded and converted into data that the model can receive; other discrete values ​​are numerically normalized.

[0120] S204: Train a first initial isolation forest model according to the first historical feature information to obtain a first detection model.

[0121] In the embodiment of the present application, constructing the first initial isolation forest model includes the following process:

[0122] 1. Build an isolation tree. isolated trees, each tree uses a subset Come to train, is randomly sampled from the sample data set. For each tree, recursively perform the following operations until the tree reaches the maximum height or the node contains less than 2 data points:

[0123] (1) Randomly select a feature ;

[0124] (2) In the characteristics Randomly select a split point within the range of ;

[0125] (3) The data set is divided into Divide into two parts and recursively build a subtree for each part.

[0126] 2. Calculate the path length. For each data point , calculate the path length h through each tree , which is the path length from the root node to the leaf node.

[0127] 3. Calculate the anomaly score. For each data point x, calculate its average path length in all trees Anomaly score Defined as:

[0128] in, is a normalization constant defined as: ,in, It is A harmonic number, , is the Euler-Mascheroni constant, which is approximately 0.577215.

[0129] 4. Anomaly Detection:

[0130] Anomaly score To sort, The closer it is to 1, the better the current point The closer to 0, the more likely it is an outlier. The more likely it is to be normal.

[0131] In the embodiment of the present application, according to the user data sample The first initial isolation forest model is iteratively trained to obtain a first detection model.

[0132] S205: Train a second initial isolation forest model according to the second historical feature information to obtain a second detection model.

[0133] In the embodiment of the present application, the process of constructing the second initial isolation forest model is the same as the process of constructing the first initial isolation forest model. The first initial isolation forest model is iteratively trained to obtain a second detection model.

[0134] In the above application embodiment, a first initial isolation model and a second initial isolation model are constructed according to a preset algorithm. Since the isolation forest is an unsupervised learning algorithm, it does not need to rely on pre-labeled abnormal samples, and thus has better adaptability and flexibility when dealing with new or unforeseen abnormal operations.

[0135] In one embodiment, Figure 8 As shown, the abnormal operation detection method of the above server also includes:

[0136] S206: Determine the risk level of the server according to the detection result.

[0137] In the embodiment of the present application, the detection result may include the total abnormality prediction score corresponding to each operation, so as to and preset threshold ranges to determine the risk level of each operation in the server.

[0138] For example, if , then the operation is a first-level risk; if , then the operation is a secondary risk; if , then the operation is a level 3 risk; if .85, the operation is a level 3 risk; if , then the operation is a non-risk operation.

[0139] S207, processing potential abnormal operations on the server according to the risk level and preset processing logic; the preset processing logic includes abnormal operation strategies corresponding to different risk levels.

[0140] In an embodiment of the present application, a correspondence between risk levels and processing logic is established in advance, so that the target processing logic is determined according to the risk level and correspondence of each abnormal operation, and potential abnormal operations of the server are processed according to the abnormal operation strategy in the target processing logic.

[0141] Exemplarily, when the abnormal operation is a level one risk, it represents an abnormality with no serious impact, and the target processing logic is an information-level alarm, including no need for immediate processing, and the abnormal behavior is recorded in the system log; when the abnormal operation is a level two risk, it represents possible abnormal behavior, and the target processing logic is a low-risk alarm, including adding a "low-risk alarm" tag to the operation instance in the system, and storing the relevant records in the low-risk alarm log. If the same operation instance triggers a low-risk alarm multiple times in a short period of time, the system will automatically upgrade the alarm level to a "medium-risk alarm" and trigger the corresponding processing flow; when the abnormal operation is a level three risk, it represents a highly suspected abnormality, and the target processing logic is a medium-risk alarm, including instructing the system to send an alarm email to operation and maintenance personnel, detailing the abnormal situation and possible risks, and the need to trigger an investigation and processing; when the abnormal operation is a level four risk, it represents a high-risk alarm, and the target processing logic is an information-level alarm, including the system immediately sending emergency emails and text message alarms to operation and maintenance personnel to ensure that the abnormal behavior receives rapid attention. If the current user has configured instance security protection, the system will automatically execute preset emergency response measures, such as isolating abnormal instances, restricting access rights, suspending suspicious operations, etc., to prevent the spread of risks.

[0142] In the above application embodiment, operations on the bare metal server are monitored and detected in real time, abnormal behaviors are identified in a timely manner, and corresponding security response measures are triggered to reduce the impact of potential security threats.

[0143] In one embodiment, a complete abnormal operation detection method of a server is provided, such as Fig. 9 As shown, the above method includes:

[0144] S1, obtaining first historical feature information and second historical feature information from a server.

[0145] S2: training a first initial isolation forest model according to the first historical feature information to obtain a first detection model.

[0146] S3: training a second initial isolation forest model according to the second historical feature information to obtain a second detection model.

[0147] S4, obtaining first characteristic information and second characteristic information of the server; the first characteristic information is user characteristic information of the target user, and the second characteristic information is characteristic information of the operation instance in the server.

[0148] S5: Input the first feature information into a pre-trained first detection model to perform abnormal operation detection to obtain a first detection result.

[0149] S6: Input the second feature information into a pre-trained second detection model to perform abnormal operation detection to obtain a second detection result.

[0150] S7, determining a first score mean and a first standard deviation based on all first abnormality prediction scores in the first detection result; and determining a second score mean and a second standard deviation based on all second abnormality prediction scores in the second detection result.

[0151] S8, determining the first prediction score of each operation based on each first abnormal prediction score, the first score mean and the first standard deviation in the first detection result; and determining the second prediction score of each operation based on each second abnormal prediction score, the second score mean and the second standard deviation in the second detection result.

[0152] S9, determining a total abnormality prediction score corresponding to each operation according to the first prediction score of each operation, the second prediction score of each operation, the preset first weight, and the preset second weight.

[0153] S10, determining a detection result according to a total abnormality prediction score corresponding to each operation and a preset score threshold.

[0154] S11, determining the actual abnormal operation status of the server.

[0155] S12, determining the detection accuracy of the detection result according to the actual abnormal operation situation, the first detection result and the second detection result.

[0156] S13, updating the first weight and the second weight according to the detection readiness rate, and replacing the first weight with the updated first weight, and replacing the second weight with the updated second weight.

[0157] S14, determining the risk level of the server according to the detection result.

[0158] S15, processing potential abnormal operations on the server according to the risk level and preset processing logic; the preset processing logic includes abnormal operation strategies corresponding to different risk levels.

[0159] In the above-mentioned abnormal operation detection method of the server, the first characteristic information and the second characteristic information of the server are obtained; the first characteristic information is the user characteristic information of the target user, and the second characteristic information is the characteristic information of the operation instance in the server; the abnormal operation detection of the server is performed according to the first characteristic information and the second characteristic information to obtain the detection result. In the process of data acquisition, the data is acquired from two dimensions, which improves the matching degree between the first characteristic information and the second characteristic information and each operation in the server, and in the process of data analysis, each operation in the server is analyzed from two dimensions, which improves the detection accuracy. Compared with the single-view detection method, the dual-view model can capture more subtle abnormal features, effectively reduce the false alarm rate, and ensure the overall security of the system.

[0160] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0161] Based on the same inventive concept, the embodiment of the present application also provides a server abnormal operation detection device for implementing the above-mentioned server abnormal operation detection method. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above-mentioned method, so the specific limitations in the embodiments of the abnormal operation detection device for one or more servers provided below can refer to the limitations of the abnormal operation detection method for the server above, and will not be repeated here.

[0162] In one embodiment, Fig.10 As shown, a device for detecting abnormal operation of a server is provided, comprising: an acquisition module 10 and a detection module 11, wherein:

[0163] The acquisition module 10 is used to acquire first characteristic information and second characteristic information of the server; the first characteristic information is user characteristic information of the target user, and the second characteristic information is characteristic information of the operation instance in the server.

[0164] The detection module 11 is used to perform abnormal operation detection on the server according to the first characteristic information and the second characteristic information to obtain a detection result.

[0165] In one embodiment, the detection module 11 includes: a first detection unit, a second detection unit and a determination unit, wherein:

[0166] The first detection unit is used to input the first feature information into a pre-trained first detection model to perform abnormal operation detection to obtain a first detection result.

[0167] The second detection unit is used to input the second feature information into a pre-trained second detection model to perform abnormal operation detection to obtain a second detection result.

[0168] The determination unit is used to determine the detection result according to the first detection result and the second detection result.

[0169] In one embodiment, the above-mentioned determination unit is specifically used to determine the total abnormality prediction score corresponding to each operation based on the first abnormality prediction score corresponding to each operation in the first detection result and the second abnormality prediction score corresponding to each operation in the second detection result; determine the detection result based on the total abnormality prediction score corresponding to each operation and a preset score threshold.

[0170] In one embodiment, the above-mentioned determination unit is specifically used to determine the first score mean and the first standard deviation based on all the first abnormal prediction scores in the first detection result; and determine the second score mean and the second standard deviation based on all the second abnormal prediction scores in the second detection result; determine the first prediction score of each operation based on each first abnormal prediction score, the first score mean and the first standard deviation in the first detection result; and determine the second prediction score of each operation based on each second abnormal prediction score, the second score mean and the second standard deviation in the second detection result; determine the total abnormal prediction score corresponding to each operation based on the first prediction score of each operation, the second prediction score of each operation, the preset first weight and the preset second weight.

[0171] In one embodiment, the above-mentioned determination unit is specifically used to determine the actual abnormal operation status of the server; determine the detection accuracy of the detection result based on the actual abnormal operation status, the first detection result and the second detection result; update the first weight and the second weight according to the detection accuracy, and replace the first weight with the updated first weight, and replace the second weight with the updated second weight.

[0172] In one embodiment, the abnormal operation detection device of the server further includes: an acquisition module, a first training module and a second training module, wherein:

[0173] An acquisition module, used to acquire first historical feature information and second historical feature information of the server;

[0174] A first training module, used for training a first initial isolation forest model according to first historical feature information to obtain a first detection model;

[0175] The second training module is used to train the second initial isolation forest model according to the second historical feature information to obtain a second detection model.

[0176] In one embodiment, the abnormal operation detection device of the server further includes: a determination module and a processing module, wherein:

[0177] The determination module is used to determine the risk level of the server according to the detection result.

[0178] The processing module is used to process potential abnormal operations of the server according to the risk level and preset processing logic; the preset processing logic includes abnormal operation strategies corresponding to different risk levels.

[0179] Each module in the abnormal operation detection device of the above server can be implemented in whole or in part by software, hardware and their combination. Each module can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to each module above.

[0180] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented:

[0181] Acquire first characteristic information and second characteristic information of the server; the first characteristic information is user characteristic information of the target user, and the second characteristic information is characteristic information of the operation instance in the server;

[0182] An abnormal operation detection is performed on the server according to the first characteristic information and the second characteristic information to obtain a detection result.

[0183] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0184] Inputting the first feature information into a pre-trained first detection model to perform abnormal operation detection to obtain a first detection result;

[0185] Inputting the second feature information into a pre-trained second detection model to perform abnormal operation detection to obtain a second detection result;

[0186] A detection result is determined according to the first detection result and the second detection result.

[0187] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0188] Determine a total abnormality prediction score corresponding to each operation according to a first abnormality prediction score corresponding to each operation in the first detection result and a second abnormality prediction score corresponding to each operation in the second detection result;

[0189] The detection result is determined based on the total anomaly prediction score corresponding to each operation and the preset score threshold.

[0190] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0191] Determine a first score mean and a first standard deviation based on all first anomaly prediction scores in the first detection result; and determine a second score mean and a second standard deviation based on all second anomaly prediction scores in the second detection result;

[0192] Determine a first prediction score for each operation according to each first abnormal prediction score, the first score mean, and the first standard deviation in the first detection result; and determine a second prediction score for each operation according to each second abnormal prediction score, the second score mean, and the second standard deviation in the second detection result;

[0193] A total abnormality prediction score corresponding to each operation is determined according to the first prediction score of each operation, the second prediction score of each operation, the preset first weight, and the preset second weight.

[0194] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0195] Determine the actual abnormal operation of the server;

[0196] Determine the detection accuracy of the detection result according to the actual abnormal operation situation, the first detection result and the second detection result;

[0197] The first weight and the second weight are updated according to the detection readiness rate, and the first weight is replaced by the updated first weight, and the second weight is replaced by the updated second weight.

[0198] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0199] Acquire first historical feature information and second historical feature information of the server;

[0200] Training a first initial isolation forest model according to the first historical feature information to obtain a first detection model;

[0201] The second initial isolation forest model is trained according to the second historical feature information to obtain a second detection model.

[0202] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0203] Determine the risk level of the server based on the detection results;

[0204] According to the risk level and preset processing logic, the server is processed for potential abnormal operations; the preset processing logic includes abnormal operation strategies corresponding to different risk levels.

[0205] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0206] Acquire first characteristic information and second characteristic information of the server; the first characteristic information is user characteristic information of the target user, and the second characteristic information is characteristic information of the operation instance in the server;

[0207] An abnormal operation detection is performed on the server according to the first characteristic information and the second characteristic information to obtain a detection result.

[0208] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0209] Inputting the first feature information into a pre-trained first detection model to perform abnormal operation detection to obtain a first detection result;

[0210] Inputting the second feature information into a pre-trained second detection model to perform abnormal operation detection to obtain a second detection result;

[0211] A detection result is determined according to the first detection result and the second detection result.

[0212] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0213] Determine a total abnormality prediction score corresponding to each operation according to a first abnormality prediction score corresponding to each operation in the first detection result and a second abnormality prediction score corresponding to each operation in the second detection result;

[0214] The detection result is determined based on the total anomaly prediction score corresponding to each operation and the preset score threshold.

[0215] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0216] Determine a first score mean and a first standard deviation based on all first anomaly prediction scores in the first detection result; and determine a second score mean and a second standard deviation based on all second anomaly prediction scores in the second detection result;

[0217] Determine a first prediction score for each operation according to each first abnormal prediction score, the first score mean, and the first standard deviation in the first detection result; and determine a second prediction score for each operation according to each second abnormal prediction score, the second score mean, and the second standard deviation in the second detection result;

[0218] A total abnormality prediction score corresponding to each operation is determined according to the first prediction score of each operation, the second prediction score of each operation, the preset first weight, and the preset second weight.

[0219] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0220] Determine the actual abnormal operation of the server;

[0221] Determine the detection accuracy of the detection result according to the actual abnormal operation situation, the first detection result and the second detection result;

[0222] The first weight and the second weight are updated according to the detection readiness rate, and the first weight is replaced by the updated first weight, and the second weight is replaced by the updated second weight.

[0223] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0224] Acquire first historical feature information and second historical feature information of the server;

[0225] Training a first initial isolation forest model according to the first historical feature information to obtain a first detection model;

[0226] The second initial isolation forest model is trained according to the second historical feature information to obtain a second detection model.

[0227] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0228] Determine the risk level of the server based on the detection results;

[0229] According to the risk level and preset processing logic, the server is processed for potential abnormal operations; the preset processing logic includes abnormal operation strategies corresponding to different risk levels.

[0230] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps:

[0231] Acquire first characteristic information and second characteristic information of the server; the first characteristic information is user characteristic information of the target user, and the second characteristic information is characteristic information of the operation instance in the server;

[0232] An abnormal operation detection is performed on the server according to the first characteristic information and the second characteristic information to obtain a detection result.

[0233] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0234] Inputting the first feature information into a pre-trained first detection model to perform abnormal operation detection to obtain a first detection result;

[0235] Inputting the second feature information into a pre-trained second detection model to perform abnormal operation detection to obtain a second detection result;

[0236] A detection result is determined according to the first detection result and the second detection result.

[0237] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0238] Determine a total abnormality prediction score corresponding to each operation according to a first abnormality prediction score corresponding to each operation in the first detection result and a second abnormality prediction score corresponding to each operation in the second detection result;

[0239] The detection result is determined based on the total anomaly prediction score corresponding to each operation and the preset score threshold.

[0240] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0241] Determine a first score mean and a first standard deviation based on all first anomaly prediction scores in the first detection result; and determine a second score mean and a second standard deviation based on all second anomaly prediction scores in the second detection result;

[0242] Determine a first prediction score for each operation according to each first abnormal prediction score, the first score mean, and the first standard deviation in the first detection result; and determine a second prediction score for each operation according to each second abnormal prediction score, the second score mean, and the second standard deviation in the second detection result;

[0243] A total abnormality prediction score corresponding to each operation is determined according to the first prediction score of each operation, the second prediction score of each operation, the preset first weight, and the preset second weight.

[0244] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0245] Determine the actual abnormal operation of the server;

[0246] Determine the detection accuracy of the detection result according to the actual abnormal operation situation, the first detection result and the second detection result;

[0247] The first weight and the second weight are updated according to the detection readiness rate, and the first weight is replaced by the updated first weight, and the second weight is replaced by the updated second weight.

[0248] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0249] Acquire first historical feature information and second historical feature information of the server;

[0250] Training a first initial isolation forest model according to the first historical feature information to obtain a first detection model;

[0251] The second initial isolation forest model is trained according to the second historical feature information to obtain a second detection model.

[0252] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0253] Determine the risk level of the server based on the detection results;

[0254] According to the risk level and preset processing logic, the server is processed for potential abnormal operations; the preset processing logic includes abnormal operation strategies corresponding to different risk levels.

[0255] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0256] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0257] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A method for detecting abnormal operation of a server, characterized in that: The method comprises: Acquire first characteristic information and second characteristic information of the server; the first characteristic information is user characteristic information of a target user, and the second characteristic information is characteristic information of an operation instance in the server; An abnormal operation detection is performed on the server according to the first characteristic information and the second characteristic information to obtain a detection result.

2. The method according to claim 1, characterized in that The performing abnormal operation detection on the server according to the first characteristic information and the second characteristic information to obtain a detection result includes: Inputting the first feature information into a pre-trained first detection model to perform abnormal operation detection to obtain a first detection result; Inputting the second feature information into a pre-trained second detection model to perform abnormal operation detection to obtain a second detection result; The detection result is determined according to the first detection result and the second detection result.

3. The method according to claim 2, characterized in that Determining the detection result according to the first detection result and the second detection result includes: Determine a total abnormality prediction score corresponding to each operation according to a first abnormality prediction score corresponding to each operation in the first detection result and a second abnormality prediction score corresponding to each operation in the second detection result; The detection result is determined according to the total abnormality prediction score corresponding to each of the operations and a preset score threshold.

4. The method according to claim 3, characterized in that The determining, according to the first abnormality prediction score corresponding to each operation in the first detection result and the second abnormality prediction score corresponding to each operation in the second detection result, a total abnormality prediction score corresponding to each operation includes: Determine a first score mean and a first standard deviation based on all first anomaly prediction scores in the first detection result; and determine a second score mean and a second standard deviation based on all second anomaly prediction scores in the second detection result; Determine a first prediction score for each of the operations according to each first abnormality prediction score in the first detection result, the first score mean, and the first standard deviation; and determine a second prediction score for each of the operations according to each second abnormality prediction score in the second detection result, the second score mean, and the second standard deviation; According to the first prediction score of each operation, the second prediction score of each operation, the preset first weight and the preset second weight, a total abnormality prediction score corresponding to each operation is determined.

5. The method according to claim 4, characterized in that The method further comprises: Determining the actual abnormal operation of the server; Determining a detection accuracy rate of the detection result according to the actual abnormal operation situation, the first detection result, and the second detection result; The first weight and the second weight are updated according to the detection readiness rate, and the first weight is replaced by the updated first weight, and the second weight is replaced by the updated second weight.

6. The method according to any one of claims 1 to 5, characterized in that: The training process of the first detection model and the second detection model includes: Acquire first historical feature information and second historical feature information of the server; Training a first initial isolation forest model according to the first historical feature information to obtain the first detection model; The second initial isolation forest model is trained according to the second historical feature information to obtain the second detection model.

7. The method according to any one of claims 1 to 5, characterized in that: The method further comprises: Determining a risk level of the server according to the detection result; According to the risk level and preset processing logic, potential abnormal operation processing is performed on the server; the preset processing logic includes abnormal operation strategies corresponding to different risk levels.

8. A device for detecting abnormal operation of a server, characterized in that: The device comprises: An acquisition module, used to acquire first characteristic information and second characteristic information of the server; the first characteristic information is user characteristic information of a target user, and the second characteristic information is characteristic information of an operation instance in the server; A detection module is used to perform abnormal operation detection on the server according to the first characteristic information and the second characteristic information to obtain a detection result.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images