Risk warning methods, devices, computer equipment, storage media and program products

Abstract

This application relates to the field of cloud security technology, and in particular to a risk warning method, device, computer equipment, storage medium, and program product. The method includes acquiring system information of a target system, including the status data of each node; processing the system information by calling a risk identification model to obtain a risk identification result for the target system output by the risk identification model; the risk identification result includes the probability of each risk type occurring; wherein the risk identification model is trained based on training samples, which are constructed based on historical risk events of the target system, including system information corresponding to the target system at the time of historical failures, and the status of each risk type; updating the risk trend map of the target system based on the risk identification result, and sending the updated risk trend map to the target device. Using the method of this application can improve the accuracy of risk warnings for the overall cloud service.

Description

Technical Field

[0001] This application relates to the field of cloud security technology, and in particular to a risk warning method, device, computer equipment, storage medium, and program product. Background Technology

[0002] With the development of cloud computing technology, various services based on cloud computing are constantly being updated; and with enterprises paying close attention to security incidents, the operation and maintenance management of various services has become particularly important.

[0003] Taking the current mainstream SaaS (Software as a Service) cloud service as an example, the SaaS cloud service log processing solution in related technologies usually adopts a centralized approach to log processing. It judges whether there is a fault through preset rules and performs monitoring and alarms. The centralized approach means that each module only monitors and analyzes its own data or data of specific protection points, thereby providing fault alerts for each module.

[0004] However, SaaS services often involve complex and diverse interfacing systems and varied logs. Furthermore, with the addition of new interfacing systems and the deployment of clusters, the risks and failures of the entire cloud service become increasingly diverse. Moreover, due to hardware and data interdependencies between modules, a failure in one module may not be caused by that module itself. In other words, related technologies often overlook the interrelationships between system modules, leading to inaccurate risk analysis results for each module.

[0005] Therefore, improving the accuracy of risk warnings for cloud services as a whole is an urgent problem to be solved. Summary of the Invention

[0006] Therefore, it is necessary to provide a risk warning method, device, computer equipment, storage medium, and program product that can improve the accuracy of risk warning for the overall cloud service in response to the above-mentioned technical problems.

[0007] Firstly, this application provides a risk warning method, including:

[0008] Obtain system information of the target system, including the status data of each node;

[0009] The system information is processed by calling a risk identification model to obtain the risk identification result for the target system output by the risk identification model; the risk identification result includes the probability of each risk type occurring; wherein, the risk identification model is trained based on training samples, the training samples are constructed based on each historical risk event of the target system, and the historical risk events include the system information corresponding to the target system at the time of historical failure, and the status of each risk type.

[0010] Based on the risk identification results, the risk trend map of the target system is updated, and the updated risk trend map is sent to the target device.

[0011] In one embodiment, the training process of the risk identification model includes:

[0012] Multiple historical risk events of the target system are obtained, and each historical risk event is analyzed to determine the associated node corresponding to each risk type;

[0013] For each risk type, based on the associated node corresponding to the risk type, determine the risk factor of the risk type in each historical risk event;

[0014] For the state of the risk factor and the risk type in each of the historical risk events, construct the training sample;

[0015] The initial model is trained based on the training samples to obtain the risk identification model.

[0016] In one embodiment, the step of parsing each of the historical risk events to obtain the associated node corresponding to each risk type includes:

[0017] For each of the aforementioned risk types, using each of the aforementioned historical risk events as source data, the correlation between the risk type and each of the aforementioned nodes is determined from the source data;

[0018] Based on the correlation, the associated node corresponding to the risk type is determined.

[0019] In one embodiment, constructing the training samples for the state of the risk factor and the risk type in each of the historical risk events for the risk type includes:

[0020] Based on the correlation, the risk factors corresponding to the risk type are weighted;

[0021] The weighted risk factors are used as sample data, and the status of the risk type is used as the sample label to construct a training sample.

[0022] In one embodiment, training the initial model based on each of the training samples to obtain the risk identification model includes:

[0023] The training samples are divided into training set and test set;

[0024] The initial model is trained based on the training set, and the trained initial model is tested based on the test set to obtain test results;

[0025] If the test results meet the preset conditions, then the trained initial model is determined to be the risk identification model.

[0026] In one embodiment, the method further includes:

[0027] Based on the risk identification results, the weight corresponding to each risk type is determined from the mapping table, which includes the correspondence between the probability of each risk type and its weight.

[0028] Based on the weight corresponding to each of the aforementioned risk types, a performance evaluation for the target system is determined.

[0029] Secondly, this application also provides a risk warning device, which includes an information acquisition module, a model processing module, and an update module, wherein:

[0030] The information acquisition module is used to acquire system information of the target system, including the status data of each node;

[0031] The model processing module is used to call the risk identification model to process the system information and obtain the risk identification result for the target system output by the risk identification model; the risk identification result includes the probability of each risk type occurring; wherein, the risk identification model is trained based on training samples, the training samples are constructed based on each historical risk event of the target system, and the historical risk events include the system information corresponding to the target system at the time of historical failure, and the status of each risk type.

[0032] The update module is used to update the risk trend map of the target system based on the risk identification results, and send the updated risk trend map to the target device.

[0033] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0034] Obtain system information of the target system, including the status data of each node;

[0035] The system information is processed by calling a risk identification model to obtain the risk identification result for the target system output by the risk identification model; the risk identification result includes the probability of each risk type occurring; wherein, the risk identification model is trained based on training samples, the training samples are constructed based on each historical risk event of the target system, and the historical risk events include the system information corresponding to the target system at the time of historical failure, and the status of each risk type.

[0036] Based on the risk identification results, the risk trend map of the target system is updated, and the updated risk trend map is sent to the target device.

[0037] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the following steps:

[0038] Obtain system information of the target system, including the status data of each node;

[0039] The system information is processed by calling a risk identification model to obtain the risk identification result for the target system output by the risk identification model; the risk identification result includes the probability of each risk type occurring; wherein, the risk identification model is trained based on training samples, the training samples are constructed based on each historical risk event of the target system, and the historical risk events include the system information corresponding to the target system at the time of historical failure, and the status of each risk type.

[0040] Based on the risk identification results, the risk trend map of the target system is updated, and the updated risk trend map is sent to the target device.

[0041] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, performs the following steps:

[0042] Obtain system information of the target system, including the status data of each node;

[0043] The system information is processed by calling a risk identification model to obtain the risk identification result for the target system output by the risk identification model; the risk identification result includes the probability of each risk type occurring; wherein, the risk identification model is trained based on training samples, the training samples are constructed based on each historical risk event of the target system, and the historical risk events include the system information corresponding to the target system at the time of historical failure, and the status of each risk type.

[0044] Based on the risk identification results, the risk trend map of the target system is updated, and the updated risk trend map is sent to the target device.

[0045] The aforementioned risk warning methods, devices, computer equipment, storage media, and program products train a risk identification model using training samples constructed from historical fault events of the target system. Since each historical fault event includes the state data of each node of the target system at the corresponding fault time, as well as the state of each risk type, the trained risk identification model has the ability to analyze the potential risks of the target system from the overall dimension of each node. Therefore, by inputting the acquired system information of the target system into the risk identification model, risk identification results including the probability of each risk type can be obtained, thereby improving the accuracy of risk identification of the target system as a whole. Furthermore, the risk identification results update the risk trend map of the target system, and the updated risk trend map is sent to the target device, so that operation and maintenance personnel can more clearly and intuitively understand the risk change trend of the target system, thereby enabling them to better prepare for risks. Attached Figure Description

[0046] To more clearly illustrate the technical solutions in the embodiments or related technologies of this application, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0047] Figure 1 This is a flowchart illustrating a risk warning method in one embodiment;

[0048] Figure 2 This is a schematic diagram of the training process of a risk identification model in one embodiment;

[0049] Figure 3 This is a flowchart illustrating the steps for determining associated nodes in one embodiment;

[0050] Figure 4This is a schematic diagram of the process of constructing training samples in one embodiment;

[0051] Figure 5 Here is an example diagram of the data structure for historical risk events in one embodiment;

[0052] Figure 6 This is a schematic diagram of the process for determining performance evaluation in one embodiment;

[0053] Figure 7 This is a flowchart illustrating the risk warning method in another embodiment;

[0054] Figure 8 This is a schematic diagram of the log reading process in another embodiment;

[0055] Figure 9 A flowchart illustrating the process of building a prediction model in another embodiment;

[0056] Figure 10 This is a flowchart illustrating the process of determining a risk level in another embodiment;

[0057] Figure 11 This is a structural block diagram of a risk warning device in one embodiment;

[0058] Figure 12 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0059] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0060] The risk warning method provided in this application is executed by a computer device, which may be, but is not limited to, various personal computers, laptops, smartphones, tablets, IoT devices, and portable wearable devices. IoT devices may include smart speakers, smart TVs, smart air conditioners, and smart in-vehicle devices. Portable wearable devices may include smartwatches, smart bracelets, and head-mounted devices. The server may be a standalone server or a server cluster consisting of multiple servers. Furthermore, the target system may be configured on the computer device executing the risk warning method of this application, or it may be configured on other computer devices; this application does not specifically limit its implementation in this regard.

[0061] In one exemplary embodiment, such as Figure 1 As shown, a risk warning method is provided, which specifically includes the following steps 10-30, wherein:

[0062] Step 10: Obtain the system information of the target system, which includes the status data of each node.

[0063] In the embodiments of this application, the system information of the target system is obtained by the data collection component; probes are pre-inserted into each node (engine) of the target system to collect historical and / or real-time status data of the corresponding node; each probe is pre-configured to communicate with the data collection component, so that the computing device can obtain the status data of each node of the target system through the data collection component.

[0064] Furthermore, the computer device can acquire system information of the target system in real time, or acquire system information of the target system based on a set acquisition frequency, or acquire system information of the target system when it receives an acquisition command triggered by the user; in this embodiment of the application, no specific limitation is made on the frequency and conditions for acquiring system information.

[0065] Step 20: Call the risk identification model to process the system information and obtain the risk identification results for the target system output by the risk identification model; the risk identification results include the probability of each risk type occurring.

[0066] In this embodiment, the risk identification model is trained based on training samples. These training samples are constructed from historical risk events of the target system. Historical risk events include system information corresponding to the target system at the time of historical failures, and the states of each risk type. In other words, the trained risk identification model can predict the probability of each risk type occurring in the target system based on real-time system information. Therefore, after obtaining real-time system information of the target system, this information is input into the risk identification model to obtain the risk identification result output by the model. In one example, if the system has three types of risks, A, B, and C, a possible risk identification result is: Risk type A - 30%, Risk type B - 70%, Risk type C - 50%.

[0067] The system information may specifically include status data for device nodes, service nodes, and port nodes. Device node status data may include CPU (Central Processing Unit) utilization, memory usage, network speed, and device temperature for each device. Service node status data may include the number of real-time tasks processed, the number of logs generated, and the number of pending tasks. Port node status data may include the communication frequency between ports and port occupancy. The status data for each type of node is not limited to the types listed in this embodiment and may include other more detailed data, depending on actual business needs. This embodiment does not impose specific limitations on this data.

[0068] Furthermore, in subsequent embodiments, the specific composition of historical fault events and the process of constructing training samples based on each historical fault event will be described in more detail, which will not be elaborated on here.

[0069] Step 30: Based on the risk identification results, update the risk trend map of the target system and send the updated risk trend map to the target device.

[0070] In this embodiment, the risk identification results output by the risk identification model each time are used to generate a risk trend chart. The risk trend chart represents the fluctuation of the probability of each risk type occurring in the target system. This embodiment does not specifically limit the type of risk trend chart. After generating the risk identification results for the target system based on real-time system information, the risk trend chart is updated based on the risk identification results to obtain the latest risk trend chart for the target system. The updated risk trend chart is then sent to the target device, enabling the system's maintenance personnel to more intuitively grasp the overall risk trend of the target system.

[0071] Because there are hardware or data interactions between modules, a failure in one module may not be caused by that module itself. However, related technologies typically monitor each module of the target system independently, generating risk analysis results for each module based on its data. In other words, these technologies neglect the interrelationships between the system's modules, leading to inaccurate risk analysis results for each individual module.

[0072] In the aforementioned fault identification method, the risk identification model is trained using training samples constructed from historical fault events of the target system. Since each historical fault event includes the state data of each node of the target system at the corresponding fault time, as well as the state of each risk type, the trained risk identification model has the ability to analyze the potential risks of the target system from the overall dimension of each node. Therefore, by inputting the acquired system information of the target system into the risk identification model, a risk identification result including the probability of each risk type can be obtained, thereby improving the accuracy of risk identification of the target system as a whole. Furthermore, the risk identification result updates the risk trend map of the target system, and the updated risk trend map is sent to the target device, so that operation and maintenance personnel can more clearly and intuitively understand the risk change trend of the target system, thereby enabling them to better prepare for risks.

[0073] In one embodiment, reference Figure 2 The training process of the risk identification model can specifically include steps 01-04, wherein:

[0074] Step 01: Obtain multiple historical risk events of the target system, analyze each historical risk event, and determine the associated nodes corresponding to each risk type.

[0075] Specifically, the acquired historical risk events are first preprocessed using normalization or one-hot encoding to unify the dimensions of the various types of state data, thereby improving the convenience and effectiveness of subsequent analysis. Then, the preprocessed historical risk events are analyzed to determine the associated nodes for each risk type. For each risk type, the key data type needs to be determined; that is, analyzing each risk event involves identifying the key nodes for each risk type, where each key node represents a data type.

[0076] Step 02: For each risk type, based on the associated nodes corresponding to the risk type, determine the risk factor of the risk type in each historical risk event;

[0077] Step 03: Construct training samples for the state of risk factors and risk types in each historical risk event.

[0078] Specifically, after identifying the key nodes corresponding to each risk type, for each risk type, data corresponding to that risk type is extracted from each historical risk event as a risk factor based on the key nodes corresponding to that risk type. For example, in a possible example, a historical risk event Q1 includes data from six nodes: Aa, Bb, Cc, Dd, Ee, and Ff. The uppercase letter AF represents the type of the node, and the lowercase letter af represents the state data corresponding to that node. For example, for a risk type S1, if the key nodes corresponding to risk type S1 are identified as A, E, and F, the risk factor data obtained from historical risk events Q1 based on risk type S1 are Aa, Ee, and Ff, where the data from each node, Aa, Ee, and Ff, each serve as a risk factor.

[0079] Then, further, each risk factor corresponding to a risk type in a historical risk event, and the state of that risk type in that historical risk event, are used as a training sample. The state of the risk type can be 1 or 0; where 1 indicates that the risk type has occurred, and 0 indicates that the risk type has not occurred.

[0080] The number of risk types in each historical risk event is the same, representing all possible risks to the target system; however, the states of each risk type are not necessarily the same in each historical risk event. In other words, the number of training samples that can be generated for each historical risk event is the same as the number of risk types. For example, if each historical risk event corresponds to 5 risk type states, then each historical risk event can generate 5 training samples, meaning that each risk type can generate one training sample in each historical risk event. The total number of training samples is... ,but ,in, The number of risk types, This refers to the number of historical risk events.

[0081] Step 04: Train the initial model based on each training sample to obtain the risk identification model.

[0082] Furthermore, the initial model is trained using the training samples constructed in steps 01-03 to obtain the risk identification model. The initial model can be a multiple linear regression model, or other types of network models; however, this embodiment does not specifically limit the type of the initial model.

[0083] The above describes the process of training a risk identification model. The following content further explains how to determine the associated nodes for each risk type and how to construct a training sample.

[0084] Furthermore, in one embodiment, reference is made to Figure 3 Step 01, the process of determining the associated nodes corresponding to each risk type, may specifically include steps 011 and 012, wherein:

[0085] Step 011: For each risk type, use each historical risk event as source data, and determine the correlation between the risk type and each node from the source data;

[0086] Step 012: Based on correlation, determine the associated nodes corresponding to the risk type.

[0087] Specifically, correlation characterizes the contribution of node type to the risk corresponding to the occurrence of risk type. In the embodiments of this application, the Pearson correlation coefficient between each risk type and each node type is determined from the source data. The Pearson correlation coefficient between risk type and node type is the correlation between the two.

[0088] The Pearson correlation coefficient between the target risk type and the target node type can be determined by formula (1).

[0089] in, Formula (1); Each historical risk event is derived from... If we perform non-repeating numbering, then For the first Status data corresponding to the target node type in a historical risk event. This represents the average value of the status data corresponding to the target type node across various historical risk events. For the first The status of the target risk type in a historical risk event. This represents the average state of the target risk type across all historical risk events.

[0090] Furthermore, for each risk type, the correlation between the risk type and each node type is determined using formula (1); then, the node types are arranged in descending order of correlation, and the top N% of node types are selected as the associated nodes corresponding to that risk type. Wherein, if the value corresponding to N% is not an integer, it is rounded up. Thus, the associated nodes corresponding to each risk type can be determined through the above method. In one possible implementation, N can be 30; however, the value of N may differ for different systems, and the specific value of N is not limited in this embodiment.

[0091] Since the associated nodes for each risk type are determined from the historical risk events of the target system, the key nodes for each risk type characterize the features of the target system. In one example, there are three associated nodes for the downtime risk: CPU utilization, content usage, and log generation. Among them, CPU utilization has the highest correlation with the downtime risk type, while log generation has the lowest correlation.

[0092] Furthermore, referring to Figure 4 In step 03, the process of constructing training samples may specifically include steps 031 and 032, wherein:

[0093] Step 031: Based on correlation, weight the risk factors corresponding to the risk type;

[0094] Step 032: Use the weighted risk factors as sample data and the risk type status as sample label to construct a training sample.

[0095] Specifically, for each risk type, based on the associated nodes corresponding to that risk type, state data corresponding to each associated node is extracted from each historical risk event, and each state data is treated as a risk factor. Then, each risk factor corresponding to that risk type in the historical risk event is used as a set of sample data, and the state corresponding to that risk type in the historical risk event is used as a sample label. The sample data and sample labels are then used to construct a set of training samples. Each risk factor in the sample data is assigned a weight based on the correlation between the node type it corresponds to and the risk type; the higher the correlation, the greater the weight. However, this embodiment does not specifically limit the relationship between correlation and weight ratio.

[0096] In one example, such as Figure 5 As shown, there exists There are 6 historical risk events, each containing state data of 6 node types (AF), corresponding to states of 4 risk types (S, P, K, and T). Let A, B, and C be the associated nodes for risk type S. Then, the risk factors corresponding to risk type S in historical risk event 1 are a1, b1, and c1; and the risk factors corresponding to risk type S in historical risk event n are an, bn, and cn. Further, based on the correlation between nodes A, B, and C and risk type S, the risk factors corresponding to each node type are weighted. For example, the weights of A, B, and C with S are 0.5, 0.3, and 0.2, respectively. Then, 0.5a1, 0.3b1, and 0.2c1 are used as sample data, with state 1 corresponding to S in the historical risk event as the sample label to construct a training sample of risk type S for historical risk event 1; and 0.5an, 0.3bn, and 0.2cn are used as sample data, with state 1 corresponding to S in historical risk event n as the sample label to construct a training sample of risk type S for historical risk event n.

[0097] Specifically, if the state of a risk type in the training sample indicates that the risk type has occurred, then the training sample is a positive sample; if the state of a risk type in the training sample indicates that the risk type has not occurred, then the training sample is a negative sample.

[0098] Steps 011 and 012, as well as steps 031 and 032 above, further elaborate on how to determine the associated nodes corresponding to each risk type and how to construct a training sample.

[0099] In this embodiment, the training samples constructed through steps 01-03 are divided into a test set and a training set. The initial model is then trained based on the training set, and the trained initial model is tested based on the test set to obtain test results. If the test results meet preset conditions, the trained initial model is determined to be a risk identification model. The ratio of the test set to the training set is not specifically limited in this embodiment; in one possible implementation, the ratio is 7:3.

[0100] Specifically, in the embodiments of this application, the loss function of the initial model is formula (2).

[0101] Formula (2). Wherein, It is the total number of training samples in the training set; the predicted risk value. For the initial model to the first The risk type predicted from the sample data of each training sample, and the actual risk value. It is the first The state of risk type in each training sample; among which... Furthermore, the training result can be the trend of the loss function or the value of the loss function. The preset conditions differ depending on the type of training result; that is, each type of training result corresponds to a preset condition. For example, when the training result is the value of the loss function, the preset condition can be that the value of the loss function is less than the coefficient of determination. The coefficient of determination can be set by the user, and this embodiment does not specifically limit its value.

[0102] In one embodiment of this application, to facilitate a better description of the overall performance of the target system, steps 40 and 50 are further included in this embodiment, referring to... Figure 6 ,in:

[0103] Step 40: Based on the risk identification results, determine the weight corresponding to each risk type from the mapping table. The mapping table includes the correspondence between the probability of each risk type and its weight.

[0104] Step 50: Determine the performance evaluation for the target system based on the weight corresponding to each risk type.

[0105] Specifically, the probability of each risk type is divided into intervals, resulting in multiple consecutive probability intervals for each risk type. Each probability interval represents the severity of the risk type, i.e., the level of the risk type. The mapping table contains the weights corresponding to each probability interval for each risk type. After obtaining the risk identification result output by the risk identification model, for each risk type, the target probability interval corresponding to the probability of the risk type is determined. Then, the mapping table is retrieved, and the weight corresponding to each risk type in the risk identification result is obtained from the mapping table. The probability of each risk type is multiplied by its corresponding weight, and the probabilities of all risk types are multiplied by their corresponding weights and then summed to obtain the performance evaluation of the target system. The specific correspondence between the probability of each risk type and its weight is not limited in this embodiment.

[0106] In the above technical solution, updating the risk trend chart of the target system allows maintenance personnel to intuitively understand the probability and changing trends of each risk type occurring in the target system. Furthermore, determining the performance evaluation of the target system allows maintenance personnel to intuitively understand the current overall operating status of the target system. Moreover, in the risk identification results, for risk types with a probability greater than a set threshold, the corresponding solutions are determined and sent to the target device to provide relevant prompts to maintenance personnel.

[0107] In one exemplary embodiment, a risk warning method is provided, applied to a computer device. The target system can be a computer device configured to execute the risk warning method of this application embodiment, or it can be configured on other computer devices; this application does not specifically limit this. (Refer to...) Figure 7 The overall flowchart of this method may specifically include steps S1-S5, wherein:

[0108] S1. Collect data from the surrounding area, in a decentralized manner;

[0109] S2. Collect risk parameter data and use machine learning to build a predictive model to identify risk factors;

[0110] S3. Utilize a cloud-native security operations log platform to collect logs from various components, feed real-time monitoring data back to the predictive model, and update risk data in real time.

[0111] S4. Based on risk assessment data, risk levels are divided into multiple levels to achieve effective management of different risk levels;

[0112] S5. During the specified running time of the prediction model or business access of the business system, the real-time collected data is used to comprehensively evaluate and optimize the model to improve the accuracy of the prediction model.

[0113] Specifically, this method utilizes three components on the computer equipment: a data collection component, a predictive model building component, and a real-time monitoring component. The data collection component is decentralized and collects data related to the system's periphery, running on each engine node. The predictive model component collects indicator data related to system risk, uses machine learning to build a predictive model (risk identification model), identifies factors that may cause risk, and runs on a separate central server. The real-time monitoring component monitors the collected data in real time, feeds real-time data back to the predictive model, updates risk assessment data in real time, and provides customized early warnings based on trends and key indicators.

[0114] Furthermore, the following content elaborates on the functions and uses of each component in more detail.

[0115] In this embodiment of the application, a Collector component service is deployed on each node that is connected to the cloud SaaS service (target system); a predictive model component model service is deployed on the central cloud server (computer device that executes the risk warning method of this application); a monitor service is deployed on the central cloud server, which can customize the risk level and risk notification and draw the risk trend of the system; and on the data platform, all data is aggregated and an interface is provided to the model service.

[0116] In step S1, specifically, the Collector component runs on each node of the system (target system), sharing the same container with the system. Through probes, it supports real-time reading of business and security logs from each node of the system, reading key log information using delimiters, parsing and processing various fields in the logs, and then uploading the batch logs to the data collection platform. The process of reading node logs is as follows: Figure 8 As shown, where: log_file represents the log file, file_parse represents parsing the log file, Log_parse represents the path of the log file, writer represents the object to be written (generated) to the log file, Parse_1-Parse_n represent path points; write_1-write_n represent the sequence number of the object to be written; secure_data represents security data, system represents the target system, and log_cluster represents the log cluster.

[0117] In one embodiment, reference Figure 9 In step S2, the specific process of constructing the prediction model may include steps S21-S26, wherein:

[0118] S21. Obtain risk factors, including system status and business operations, through analysis of business systems and historical alarms;

[0119] S22. Based on the collected risk data, perform feature selection and select a risk factor dataset;

[0120] S23. Divide the risk factors into training and test sets;

[0121] S24. Select multiple linear regression combined with decision tree to construct a prediction model;

[0122] S25. Based on the training set, train the prediction model and fine-tune the parameters to obtain the trained prediction model;

[0123] S26. Evaluate the trained prediction model based on the training set.

[0124] Specifically, a predictive model component (model) is built to construct the predictive model, and this component runs on a separate server. The first step involves collecting relevant risk factors. This is done through analysis of the business system and historical alerts, identifying potential risk factors, including system status and business processes. Feature selection is then performed to select the risk factor data to participate in the model. Feature selection specifically involves calculating the Pearson correlation coefficient between each risk factor and the SaaS cloud service. A coefficient closer to 1 indicates a stronger relationship between the two variables. The risk factors are then sorted in descending order, and the top 30% are selected as the risk factor dataset. The second and third steps involve dividing the collected risk factor dataset into training and test sets. 70% of the data is selected as the training set for training and parameter tuning, while the remaining 30% is used as the test set to evaluate the predictive model's performance.

[0125] The fourth step involves constructing a predictive model using a combination of multiple linear regression and decision trees. Using the risk factor dataset selected in the first step and the relationship between cloud service risks, a linear regression model is built to describe the quantitative relationship between parameters and systemic risk. The decision tree, based on the threshold or information gain of risk factors, performs hierarchical partitioning among multiple parameters to discover patterns and risk factors that trigger systemic risks. The fifth step involves multiple rounds of training, validation, and parameter tuning of the predictive model based on the training set, resulting in the trained predictive model.

[0126] The sixth step is to evaluate the trained prediction model using a test set. Mean squared error and coefficient of determination are used to measure the model's fit and accuracy. Newly collected data is then used to comprehensively evaluate and optimize the model, such as during specified periods of model operation or business system access, to improve the accuracy of the prediction model.

[0127] In one embodiment, such as Figure 10 As shown, step S4 may specifically include steps S41-S44, wherein:

[0128] Step S41: Divide the risk level into multiple levels;

[0129] Step S42: Based on historical experience, determine the risk value range for each level;

[0130] Step S43: Use the analytic hierarchy process (AHP) to weight each risk factor and obtain the results;

[0131] Step S44: Take appropriate management measures according to the risk level.

[0132] By feeding real-time data collected by the monitoring component into the predictive model, the model is updated in real time. Based on the output of the predictive model, real-time risk assessment is performed and risk trends are recorded. The risk assessment is quantified, and the risk level (performance evaluation) can be divided into multiple levels. Based on historical experience, the risk value range of each risk level is determined. The analytic hierarchy process is used to weight each risk factor to obtain the results. This allows for timely understanding of changes in cloud service risks, providing managers with real-time early warnings and improving the effectiveness of risk management.

[0133] This application's risk warning method collects multiple indicators related to cloud services to comprehensively consider the combined impact of these indicators. A predictive model is built using machine learning to train and learn from the collected indicators, identify risk factors, and perform weight analysis on these factors. Collected logs are fed back into the predictive model for real-time monitoring and timely warnings. This method is characterized by high quantitative and real-time requirements, enabling quantitative risk warnings. Compared with existing technologies, it has the following advantages:

[0134] By using machine learning to comprehensively consider multiple risk indicators and train the weights of these indicators, further evaluation can be conducted to obtain risk trends and view the overall trend of the system's state.

[0135] Versatility: By providing a universal predictive model, it supports real-time analysis of a variety of different risk factors;

[0136] Real-time performance: By monitoring the status of equipment at the minute level and through real-time data processing mechanisms, the real-time performance of processing is improved.

[0137] Identify risk trends in systems or services: Help security managers identify the security status of assets or systems, and make advance security status judgments on assets or services based on assessment results, so as to take corresponding security measures.

[0138] Improve management efficiency and reduce costs: Real-time risk quantification assessment can improve management efficiency and reduce management and maintenance costs.

[0139] Enhanced security and visibility: Risk values ​​and trends are monitored in real time from different dimensions on the monitoring screen (target device) through risk assessment methods, and real-time alarms are issued through threshold configuration.

[0140] It should be understood that although the steps in the flowcharts of the above embodiments are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the above embodiments may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0141] Based on the same inventive concept, this application also provides a risk warning device for implementing the risk warning method described above. The solution provided by this device is similar to the solution described in the above method; therefore, the specific limitations in one or more risk warning device embodiments provided below can be found in the limitations of the risk warning method described above, and will not be repeated here.

[0142] In one exemplary embodiment, such as Figure 11 As shown, a risk warning device is provided, including an information acquisition module 1101, a model processing module 1102, and an update module 1103, wherein:

[0143] Information acquisition module 1101 is used to acquire system information of the target system, including the status data of each node;

[0144] The model processing module 1102 is used to call the risk identification model to process system information and obtain the risk identification results for the target system output by the risk identification model; the risk identification results include the probability of each risk type occurring; wherein, the risk identification model is trained based on training samples, and the training samples are constructed based on the historical risk events of the target system;

[0145] The update module 1103 is used to update the risk trend map of the target system based on the risk identification results, and send the updated risk trend map to the target device.

[0146] In one embodiment, the risk warning device further includes a training module, which is specifically used for:

[0147] Obtain multiple historical risk events of the target system, analyze each historical risk event, and determine the associated nodes corresponding to each risk type;

[0148] For each risk type, the risk factor of the risk type in each historical risk event is determined based on the associated nodes corresponding to the risk type.

[0149] For each historical risk event, construct training samples to represent the risk factors and risk type status of each risk type.

[0150] The initial model is trained based on each training sample to obtain the risk identification model.

[0151] In one embodiment, the training module is further configured to:

[0152] For each risk type, historical risk events are used as source data to determine the correlation between the risk type and each node.

[0153] Based on correlation, identify the associated nodes corresponding to the risk types.

[0154] In one embodiment, the training module is further configured to:

[0155] Based on correlation, risk factors corresponding to risk types are weighted.

[0156] A training sample is constructed by using the weighted risk factors as sample data and the risk type status as sample label.

[0157] In one embodiment, the training module is further configured to:

[0158] The training samples are divided into training set and test set;

[0159] The initial model is trained based on the training set, and the trained initial model is tested based on the test set to obtain the test results;

[0160] If the test results meet the preset conditions, the initial model after training is determined to be the risk identification model.

[0161] In one embodiment, the risk warning device further includes a performance evaluation module, which is specifically used for:

[0162] Based on the risk identification results, the weight corresponding to each risk type is determined from the mapping table, which includes the correspondence between the probability of each risk type and its weight.

[0163] Based on the weight corresponding to each risk type, a performance evaluation for the target system is determined.

[0164] Each module in the aforementioned risk warning device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0165] In one exemplary embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 12 As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, NFC (Near Field Communication), or other technologies. When the computer program is executed by the processor, it implements a risk warning method. The display unit is used to form a visually visible image and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0166] Those skilled in the art will understand that Figure 12 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0167] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement any of the steps described in the above-described risk warning method embodiments.

[0168] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements any of the steps described in the above-described risk warning method embodiments.

[0169] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements any of the steps described in the risk warning method embodiments above.

[0170] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0171] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0172] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0173] The above embodiments are merely illustrative of several implementation methods of this application, and their descriptions are relatively specific and detailed. However, they should not be construed as limiting the scope of this application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A risk warning method, characterized in that, The method includes: Obtain system information of the target system, including the status data of each node; The system information is processed by calling a risk identification model to obtain the risk identification result for the target system output by the risk identification model; the risk identification result includes the probability of occurrence of each risk type; wherein, the risk identification model is trained based on training samples, the training samples are constructed based on each historical risk event of the target system, and the historical risk events include the system information corresponding to the target system at the time of historical failure, and the status of each risk type. Based on the risk identification results, the risk trend map of the target system is updated, and the updated risk trend map is sent to the target device; The training process of the risk identification model includes: Multiple historical risk events of the target system are obtained, and each historical risk event is analyzed to determine the associated node corresponding to each risk type; For each risk type, based on the associated node corresponding to the risk type, determine the risk factor of the risk type in each historical risk event; For the state of the risk factor and the risk type in each of the historical risk events, construct the training sample; The initial model is trained based on the training samples to obtain the risk identification model.

2. The method according to claim 1, characterized in that, The process of analyzing each of the aforementioned historical risk events to obtain the associated nodes corresponding to each risk type includes: For each of the aforementioned risk types, using each of the aforementioned historical risk events as source data, the correlation between the risk type and each of the aforementioned nodes is determined from the source data; Based on the correlation, the associated node corresponding to the risk type is determined.

3. The method according to claim 2, characterized in that, The construction of the training samples for the state of the risk factor and the risk type in each historical risk event of the risk type includes: Based on the correlation, the risk factors corresponding to the risk type are weighted; The weighted risk factors are used as sample data, and the status of the risk type is used as the sample label to construct a training sample.

4. The method according to claim 3, characterized in that, The step of training the initial model based on each of the training samples to obtain the risk identification model includes: The training samples are divided into training set and test set; The initial model is trained based on the training set, and the trained initial model is tested based on the test set to obtain test results; If the test results meet the preset conditions, then the trained initial model is determined to be the risk identification model.

5. The method according to any one of claims 1-4, characterized in that, The method further includes: Based on the risk identification results, the weight corresponding to each risk type is determined from the mapping table, which includes the correspondence between the probability of occurrence of each risk type and its weight. Based on the weight corresponding to each of the aforementioned risk types, a performance evaluation for the target system is determined.

6. A risk warning device, characterized in that, The device includes an information acquisition module, a model processing module, an update module, and a training module, wherein: The information acquisition module is used to acquire system information of the target system, including the status data of each node; The model processing module is used to call the risk identification model to process the system information and obtain the risk identification result for the target system output by the risk identification model; the risk identification result includes the probability of occurrence of each risk type; wherein, the risk identification model is trained based on training samples, the training samples are constructed based on each historical risk event of the target system, and the historical risk events include the system information corresponding to the target system at the time of historical failure, and the status of each risk type. The update module is used to update the risk trend map of the target system based on the risk identification results, and send the updated risk trend map to the target device; The training module is specifically used for: Multiple historical risk events of the target system are obtained, and each historical risk event is analyzed to determine the associated node corresponding to each risk type; For each risk type, based on the associated node corresponding to the risk type, determine the risk factor of the risk type in each historical risk event; For the state of the risk factor and the risk type in each of the historical risk events, construct the training sample; The initial model is trained based on the training samples to obtain the risk identification model.

7. The apparatus according to claim 6, characterized in that, The training module is also used for: For each of the aforementioned risk types, using each of the aforementioned historical risk events as source data, the correlation between the risk type and each of the aforementioned nodes is determined from the source data; Based on the correlation, the associated node corresponding to the risk type is determined.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 5.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

Images