Abnormality determination method and device, electronic equipment, storage medium and program product

Abstract

The invention discloses an exception determination method and device, electronic equipment, a storage medium and a program product. According to the specific implementation scheme, the method comprises the steps that original data are processed into security basic data through a unified data model, and the security basic data are transmitted to a security basic data field; constructing graph data based on the security basic data in the security basic data field and mapping data corresponding to the security basic data through a construction model, and transmitting the graph data to a detection model; determining abnormal data corresponding to the original data based on the graph data through the detection model; and determining an abnormal event corresponding to the abnormal data in the to-be-detected object based on the graph data through the construction model. According to the invention, the method achieves the detection when the to-be-detected object is abnormal, determines the corresponding abnormal data, traces the abnormal event according to the abnormal data, and completes the practical application of the multi-step detection of the to-be-detected object.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an abnormality determination method, device, electronic device, storage medium and program product. Background Art

[0002] With the continuous integration of cyberspace development and national security issues, the international cyberspace security situation is becoming increasingly severe. In particular, key infrastructure such as electricity, which is related to national livelihood and production, has become the focus of cyber warfare. As the core infrastructure of the modern power system, the power network ensures the continuity and reliability of power supply, guarantees the safe and stable operation of the power system, and plays an irreplaceable role in promoting the healthy development of the power industry and meeting the social electricity demand. It is the key security protection target of the power system. The application of new technologies and new services has increased new exposures, introduced new security risks, and put forward higher requirements for security protection. Based on trusted computing and immune technology, in addition to ensuring structural safety, ontology safety and other security protection, it also puts forward new requirements for security monitoring. By establishing an application system for comprehensive real-time monitoring of system security, rapid threat identification, attack source tracking, and active strategy generation, it supports system security prevention and control and real-time monitoring, and achieves comprehensive coverage of power information and system security.

[0003] At present, the existing monitoring system has realized the monitoring of hardware and software operation events and network events such as the middle-end host, network equipment, application software, and database, but it is limited to identifying threats within a pre-set range, such as external device access, illegal network access, and external connections. It lacks association-based threat identification and cannot achieve effective detection. Summary of the invention

[0004] The present invention provides an abnormality determination method, device, electronic device, storage medium and program product to realize detection of abnormalities of an object to be detected, and completes the practical application of multi-step detection of the object to be detected.

[0005] According to one aspect of the present invention, there is provided an abnormality determination method, comprising:

[0006] Processing the original data into security basic data through a unified data model, and transmitting the security basic data to a security basic data domain, wherein the original data includes data generated by an object to be detected, and the object to be detected includes a device in the power network that is at risk of being attacked;

[0007] Building graph data by building a model based on the security basic data in the security basic data domain and the mapping data corresponding to the security basic data, and transmitting the graph data to the detection model;

[0008] Determining, by means of the detection model and based on the graph data, abnormal data corresponding to the original data;

[0009] The abnormal event corresponding to the abnormal data in the object to be detected is determined based on the graph data by constructing the model.

[0010] According to another aspect of the present invention, there is provided an abnormality determination device, comprising:

[0011] A processing module, used to process the original data into security basic data through a unified data model, and transmit the security basic data to a security basic data domain, wherein the original data includes data generated by an object to be detected, and the object to be detected includes a device in the power network that is at risk of being attacked;

[0012] A construction module, configured to construct graph data based on the security basic data in the security basic data domain and mapping data corresponding to the security basic data by constructing a model, and transmit the graph data to a detection model;

[0013] A first determination module, configured to determine abnormal data corresponding to the original data based on the graph data by using the detection model;

[0014] The second determination module is used to determine the abnormal event corresponding to the abnormal data in the object to be detected based on the graph data by using the constructed model.

[0015] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0016] at least one processor; and

[0017] a memory communicatively connected to the at least one processor; wherein,

[0018] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the abnormality determination method described in any embodiment of the present invention.

[0019] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the abnormality determination method described in any embodiment of the present invention when executed.

[0020] According to another aspect of the present invention, a computer program product is provided. The computer program product includes a computer program. When the computer program is executed by a processor, the abnormality determination method according to any embodiment of the present invention is implemented.

[0021] The technical solution of the embodiment of the present invention processes the original data into security basic data through a unified data model, and transmits the security basic data to a security basic data domain; constructs graph data based on the security basic data in the security basic data domain and the mapping data corresponding to the security basic data through a construction model, and transmits the graph data to a detection model; determines the abnormal data corresponding to the original data based on the graph data through the detection model; determines the abnormal events corresponding to the abnormal data in the object to be detected based on the graph data through the construction model. The present invention is based on a unified data model, a construction model, and a detection model, generates corresponding graph data through the original data of the object to be detected, detects the graph data, realizes the detection of abnormalities in the object to be detected, and determines the corresponding abnormal data, traces the abnormal events based on the abnormal data, and completes the practical application of multi-step detection of the object to be detected.

[0022] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description.

[0023] It is understandable that before using the technical solutions disclosed in the embodiments of the present disclosure, the types, scope of use, usage scenarios, etc. of the personal information involved in the present disclosure should be informed to the user and the user's authorization should be obtained in an appropriate manner in accordance with relevant laws and regulations.

[0024] For example, in response to receiving an active request from a user, a prompt message is sent to the user to clearly prompt the user that the operation requested to be performed will require obtaining and using the user's personal information. Thus, the user can autonomously choose whether to provide personal information to software or hardware such as an electronic device, application, server, or storage medium that performs the operation of the technical solution of the present disclosure according to the prompt message.

[0025] As an optional but non-limiting implementation, in response to receiving an active request from the user, the prompt information may be sent to the user in the form of a pop-up window, in which the prompt information may be presented in text form. In addition, the pop-up window may also carry a selection control for the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0026] It is understandable that the above notification and the process of obtaining user authorization are merely illustrative and do not constitute a limitation on the implementation of the present disclosure. Other methods that meet the relevant laws and regulations may also be applied to the implementation of the present disclosure.

[0027] It is understandable that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and relevant provisions. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0029] Figure 1A is a flowchart of an abnormality determination method provided according to Embodiment 1 of the present invention;

[0030] Figure 1B is an architecture diagram of an abnormality determination method provided according to Embodiment 1 of the present invention;

[0031] Figure 1C is an architecture diagram of an abnormal event tracing method provided according to Embodiment 1 of the present invention;

[0032] Figure 1D is a schematic diagram of a detection model training process provided according to Embodiment 1 of the present invention;

[0033] Figure 2 is a flowchart of a method for adding a loading task provided according to Embodiment 2 of the present invention;

[0034] Figure 3 is a schematic diagram of the structure of an abnormality determination device provided according to Embodiment 3 of the present invention;

[0035] Figure 4 It is a block diagram of an electronic device provided according to a fourth embodiment of the present invention. DETAILED DESCRIPTION

[0036] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0037] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0038] Embodiment 1

[0039] FIG1 is a flowchart of an abnormality determination method provided in Embodiment 1 of the present invention. This embodiment is applicable to the case where abnormality detection is performed on an object to be detected. The method can be executed by an abnormality determination device, which can be implemented in the form of hardware and / or software, and can be configured in an electronic device. As shown in FIG1 , the method includes:

[0040] S110. Processing the original data into security basic data through a unified data model, and transmitting the security basic data to a security basic data domain, wherein the original data includes data generated by an object to be detected, and the object to be detected includes equipment in the power network that is at risk of being attacked.

[0041] In this embodiment, the unified data model can be understood as some preset rules, which can calculate and classify data, and multiple different types of models can be set for different types of data. Raw data can be understood as unprocessed data generated by nodes in the power network, and nodes can include logs or program statements, etc. Security basic data can be understood as data after the raw data is converted by the unified data model, which can include multiple types of data. The security basic data domain can be understood as a collection of security basic data. The object to be detected can be understood as a device that may be attacked in the power network, which can include security equipment, security technology defense systems, workstations, terminal equipment, control systems, network flows and external intelligence, etc. The power network can be understood as the core infrastructure of the modern power system, which is used to ensure power supply and can be built through a big data security analysis platform, a data middle platform and a unified operation center.

[0042] Specifically, the equipment with attack risks in the power network is identified as the object to be detected. When the object to be detected is running, the data of the object to be detected is collected as the original data. The original data is input into the unified data model for cleaning, alignment and association calculation to obtain the security basic data, and finally the security basic data is transmitted to the security basic data domain. The original data includes multiple types of data. Different unified data models are selected according to different data types to convert the original data.

[0043] For example, Figure 1B is an architectural diagram of an abnormality determination method provided according to Embodiment 1 of the present invention. Figure 1B The security equipment, security technology defense system, workstations, terminal equipment, control system and network flow connected to the security management platform are taken as the objects to be detected, and the original data is collected at the network boundary and key nodes of each level of the network. The original data is converted into the security basic data of seven major themes through a unified data model and placed in the security basic data domain.

[0044] S120: construct graph data based on the security basic data in the security basic data domain and the mapping data corresponding to the security basic data by constructing a model, and transmit the graph data to the detection model.

[0045] In this embodiment, the construction model is a model that can be used to construct input data into relational data, and can convert text data that is difficult for computers to understand into data based on entities and / or objects, so that the computer can establish a link relationship between entities, thereby being able to quickly associate, for example, devices, users, and behaviors. Mapping data can be understood as data corresponding to security basic data, which is used to map security basic data. Graph data can be understood as a type of relational data, in which nodes in the graph represent entities or concepts, and edges are composed of relationships or attributes between entities or concepts.

[0046] Specifically, the security basic data in the security basic data domain includes multiple types, and the mapping data corresponding to each type of security basic data is obtained. Each type of security basic data and its corresponding mapping data are input into the construction model to obtain the graph data formed by the original data, the security basic data and the mapping data. Finally, the graph data is transmitted to the detection model.

[0047] For example, Figure 1B The security basic data domain includes security basic data of seven major themes: events, intelligence, network flow, assets, alarms, status, and behavior. The security basic data of the seven major themes correspond to different mapping data, for example, event corresponding input, behavior recording time, behavior source, and behavior. The security basic data of the seven major themes and their corresponding mapping data are input into the construction model to obtain graph data, and the graph data is input into the detection model, that is, Figure 1B The multi-layered anomaly detection engine.

[0048] S130. Determine, through the detection model and based on the graph data, abnormal data corresponding to the original data.

[0049] In this embodiment, abnormal data can be understood as data corresponding to original data generated by an attacked object to be detected in the power network. The appearance of abnormal data means that the object to be detected corresponding to the abnormal data is maliciously attacked.

[0050] Specifically, the graph data is input into the detection model, and the graph data is classified and labeled to determine the category of the abnormal data in the graph data. The original data corresponding to the category is determined, and finally the abnormal data is used as the abnormal data corresponding to the original data.

[0051] Exemplarily, the graph data is input into the detection model, such as Figure 1B , the graph data can be classified and labeled through unsupervised machine learning, and the category of abnormal data in the graph data can be determined through expert review. The original data corresponding to the category is determined, and finally the abnormal data is used as the abnormal data corresponding to the original data. Abnormal data can include shell operation abnormal data or interface access abnormal data, etc.

[0052] S140: Determine the abnormal event corresponding to the abnormal data in the object to be detected based on the graph data by constructing the model.

[0053] In this embodiment, the abnormal event can be understood as an event corresponding to the abnormal data, and can be an event formed by the graph data corresponding to the abnormal data.

[0054] Specifically, we first determine the graph data corresponding to the abnormal data. Graph data is a kind of relational data. By building a model and the nodes in the graph data corresponding to the abnormal data, we can trace the security basic data and original data corresponding to the object to be detected that generated the abnormal data, so as to determine the abnormal event corresponding to the abnormal data of the object to be detected.

[0055] For example, Figure 1C 1 is an architecture diagram of an abnormal event tracing method provided according to Embodiment 1 of the present invention. Figure 1C If the abnormal data indicates an interface access anomaly, the abnormal event corresponding to the abnormal data of the object to be detected can be determined by building a model based on the graph data corresponding to the abnormal data. For example, if the abnormal data indicates an interface access anomaly, the interface access anomaly can be used as a behavior, and the object to be detected where the behavior occurs and its object state, the time when the behavior is recorded, etc. can be traced to obtain the abnormal event corresponding to the abnormal data of the object to be detected.

[0056] The technical solution of the embodiment of the present invention processes the original data into security basic data through a unified data model, and transmits the security basic data to a security basic data domain; constructs graph data based on the security basic data in the security basic data domain and the mapping data corresponding to the security basic data through a construction model, and transmits the graph data to a detection model; determines the abnormal data corresponding to the original data based on the graph data through the detection model; determines the abnormal events corresponding to the abnormal data in the object to be detected based on the graph data through the construction model. The present invention is based on a unified data model, a construction model, and a detection model, generates corresponding graph data through the original data of the object to be detected, detects the graph data, realizes the detection of abnormalities in the object to be detected, and determines the corresponding abnormal data, traces the abnormal events based on the abnormal data, and completes the practical application of multi-step detection of the object to be detected.

[0057] Based on the above embodiment, a variant embodiment of the above embodiment is proposed. It should be noted that in order to make the description concise, only the differences from the above embodiment are described in the variant embodiment.

[0058] In one embodiment, determining the abnormal data corresponding to the original data based on the graph data by using the detection model includes:

[0059] Clustering the graph data using the detection model to obtain multiple clusters;

[0060] Determine the cluster attributes of each cluster class by using the detection model, wherein the cluster attributes include normal labels and abnormal labels;

[0061] The detection model is used to determine the data in the cluster corresponding to the abnormal label as the abnormal data corresponding to the original data.

[0062] In this embodiment, the samples in the graph data are divided into several usually non-overlapping subsets, each of which is called a cluster, and each cluster corresponds to a category. The similarity of the data objects in each cluster is made as large as possible by clustering, and the difference of the data objects not in the same cluster is also made as large as possible. The cluster attributes are used to describe the characteristics of different clusters, and may include the clusters where normal data are located and the clusters where abnormal data are located. The normal label can be understood as the cluster attribute used to describe the cluster when only normal data exists in the cluster. The abnormal label can be understood as the cluster attribute used to describe the cluster when abnormal data appears in the cluster.

[0063] Specifically, the graph data is input into the detection model, and the graph data is classified and labeled, and multiple clusters can be obtained through unsupervised machine learning. Each cluster is reviewed by experts to determine the cluster attributes of each cluster, and the cluster attributes of all clusters are divided into normal labels and abnormal labels. The normal label indicates that the data in the cluster is only normal data, and the abnormal label indicates that the data in the cluster has abnormal data. The data in the cluster corresponding to the abnormal label is determined as the abnormal data corresponding to the original data.

[0064] Exemplarily, the graph data is input into the detection model, such as Figure 1B , we can classify and label the graph data through unsupervised machine learning, and divide the graph data into different clusters, including cluster 1, cluster 2, ... cluster N. We conduct expert review on each cluster to determine the cluster attributes of each cluster, and filter out the clusters corresponding to normal labels and abnormal labels. We treat the data in the cluster corresponding to the abnormal label as abnormal data to complete the detection.

[0065] In one embodiment, the training operation of the detection model includes:

[0066] Acquire a training set, wherein the training set includes historical sequence data and identification information corresponding to the historical sequence data after clustering, wherein the identification information includes a normal identification and an abnormal identification;

[0067] A clustering model is trained based on the training set to obtain a detection model.

[0068] In this embodiment, the training set can be understood as a data set for training the detection model, and the training set contains input data and its corresponding identification information so that the detection model can learn. The historical sequence data can be understood as historical graph data, which can be data from the historical period of equipment that may be attacked in the power network. The identification information can be understood as information used to identify the attributes of each cluster after the historical sequence data is clustered, and also includes normal identification and abnormal identification. The normal identification can be understood as a cluster attribute used to describe the cluster when only normal data exists in the cluster after the historical sequence data is clustered. The abnormal label can be understood as a cluster attribute used to describe the cluster when abnormal data appears in the cluster after the historical sequence data is clustered. The clustering model is an algorithm that can be used to divide the samples in the historical sequence data into several clusters, ensuring that the sample similarity within the cluster is high, and the sample similarity between different clusters is low.

[0069] Specifically, historical data of devices that may be attacked in the power network are collected and processed to form historical sequence data. The historical sequence data are clustered, and the identification information of each cluster after clustering is determined. By obtaining historical data of devices that may be attacked in the power network under various states, multiple historical sequence data and their identification information after clustering are used as training sets and input into the clustering model. The clustering model is trained using the historical sequence data to obtain a usable detection model.

[0070] For example, Figure 1D FIG. 1 is a schematic diagram of a detection model training process provided according to Embodiment 1 of the present invention. Figure 1D As shown, first, the historical data of the devices that may be attacked in the power network are collected and processed to form historical sequence data. For example, a text interactive program command or interface request sequence set input by a user every hour within a period of time is taken as a historical sequence data. The historical sequence data is clustered, and then the historical sequence data is converted into feature vectors and clustered by algorithms such as node2vec, word2vec, TF-IDF, etc., to obtain the identification information of each cluster after the historical sequence data is clustered. Based on the historical sequence data and its corresponding identification information, it is used as a training set to train the clustering model. The training process includes: inputting the data with identification information as abnormal identification into the classification model, for example, support vector machine, hidden Markov model for detection, and directly determining it as abnormal behavior if the result is abnormal and passing the result to the expert for review. Then, the classification model obtained by supervised learning is used to monitor the real-time graph data of the devices that may be attacked in the power network, and the data with abnormal identification is passed to the expert for review. For the data with abnormal identification, if the expert review considers it to be a misjudgment, it is fed back to the data with normal identification, and the clustering model is retrained regularly with the data with normal identification, and the clustering model is continuously optimized for a long time, so as to optimize the detection model.

[0071] In one embodiment, the security basic data includes data of multiple preset subjects, and the processing of the original data into the security basic data through a unified data model includes:

[0072] Through a unified data model, the original data is converted into security basic data according to the preset subject.

[0073] In this embodiment, the preset subject can be understood as a pre-set standard used to indicate the data type of the original data after conversion.

[0074] Specifically, according to the different types of raw data, the raw data is classified and merged through a variety of unified data models, and converted into security basic data according to preset topics. The preset topics can include seven major topics: events, intelligence, network flow, assets, alarms, status and behavior. Among them, events, intelligence, and network flow are semi-structured data and are stored in the unstructured platform, while assets, alarms, status and behavior are structured data and are stored in the internal database.

[0075] Optionally, the unified data model includes a plurality of sub-models, and the converting of the original data into security basic data according to the preset subject through the unified data model includes:

[0076] Determine, by means of a unified data model, a sub-model corresponding to the data type of the original data in the unified data model;

[0077] The raw data is processed by the corresponding sub-model.

[0078] In this embodiment, the sub-model can be understood as a model included in the unified data model, and different sub-models are selected according to different types of data.

[0079] Specifically, the unified data model includes multiple types of sub-models. Different sub-models are selected according to the data type of the original data. The original data is converted through the selected sub-model to obtain security basic data.

[0080] Exemplarily, the unified data model includes multiple types of sub-models, such as Figure 1B , such as event model, asset model, threat model and vulnerability model. According to the data type of the original data, select the sub-model corresponding to the data type, use the sub-model to transform the original data, and obtain the security basic data of seven major themes: event, intelligence, network flow, asset, alarm, status and behavior.

[0081] Embodiment 2

[0082] Figure 2 This is a flow chart of a method for determining an abnormal event provided in Embodiment 2 of the present invention. This embodiment is based on the method for determining an abnormal event corresponding to abnormal data in the above embodiment. Figure 2 As shown, the method includes:

[0083] S210: Determine an initial graph node in the graph data that corresponds to the abnormal data.

[0084] In this embodiment, the initial graph node can be understood as a graph node formed in the graph data by the mapping data corresponding to the security basic data.

[0085] Specifically, first determine the graph data corresponding to the abnormal data, and determine the initial graph node in the graph data according to the constructed model. The initial graph node can be mapping data, which has a corresponding relationship with the security basic data. The security basic data of the seven major themes correspond to different mapping data.

[0086] For example, Figure 1B ,The initial graph node can be one of the behavior recording time, method, object, object state, attack result, input, behavior source, behavior, attack result time and location. Assuming that the graph data corresponding to the abnormal data is security equipment-intelligence-behavior source, the initial graph node is the behavior source.

[0087] S220. Taking the initial graph node as the source, determine the intermediate node corresponding to the initial graph node along the relationship between nodes in the graph data, where the intermediate node is a graph node formed by the security basic data in the graph data.

[0088] In this embodiment, the intermediate node can be understood as a node formed by the security basic data in the graph data.

[0089] Specifically, the initial graph node is used as the source, and the intermediate node corresponding to the initial graph node is determined according to the relationship between nodes in the graph data where the initial graph node is located. The intermediate node is a node formed by the security basic data in the graph data.

[0090] For example, Figure 1B ,The intermediate node can be one of events, intelligence, network flow, assets, alarms, states and behaviors. Assuming that the graph data corresponding to the abnormal data is security equipment-intelligence-behavior source, the intermediate node is intelligence.

[0091] S230: Determine the scenario formed by the object to be detected, the intermediate node and the initial graph node as an abnormal event corresponding to the abnormal data in the object to be detected.

[0092] Specifically, the graph data corresponding to the abnormal data and the object to be detected corresponding to the original data generating the graph data are determined. The scenario formed by the object to be detected, the intermediate node and the initial graph node is regarded as an event, that is, the object to be detected, the security basic data and the mapping data corresponding to the abnormal data are regarded as abnormal events.

[0093] For example, Figure 1B ,Assuming that the graph data corresponding to the abnormal data is security equipment-intelligence-behavior source, the corresponding abnormal event is the abnormality of the behavior source data in the security equipment intelligence.

[0094] The technical solution of the embodiment of the present invention first determines the initial graph node corresponding to the abnormal data in the graph data, then takes the initial graph node as the source, and determines the intermediate node corresponding to the initial graph node along the relationship between nodes in the graph data, wherein the intermediate node is the graph node formed by the basic security data in the graph data, and finally determines the scene formed by the object to be detected, the intermediate node and the initial graph node as the abnormal event corresponding to the abnormal data in the object to be detected. The method for determining the abnormal event corresponding to the abnormal data is refined, and the determination of the abnormal event according to the graph node in the graph data is realized.

[0095] Embodiment 3

[0096] Figure 3 This is a schematic diagram of the structure of an abnormality determination device provided in Embodiment 3 of the present invention. Figure 3 As shown, the device comprises:

[0097] The processing module 310 is used to process the original data into security basic data through a unified data model, and transmit the security basic data to the security basic data domain, wherein the original data includes data generated by the object to be detected, and the object to be detected includes a device in the power network that is at risk of being attacked;

[0098] A construction module 320, configured to construct graph data based on the security basic data in the security basic data domain and mapping data corresponding to the security basic data by constructing a model, and transmit the graph data to a detection model;

[0099] A first determination module 330, configured to determine abnormal data corresponding to the original data based on the graph data by using the detection model;

[0100] The second determination module 340 is used to determine the abnormal event corresponding to the abnormal data in the object to be detected based on the graph data by using the constructed model.

[0101] In the abnormality determination device provided by the embodiment of the present invention, the processing module processes the original data into security basic data through a unified data model, and transmits the security basic data to the security basic data domain; the construction module constructs graph data based on the security basic data in the security basic data domain and the mapping data corresponding to the security basic data through a construction model, and transmits the graph data to the detection model; the first determination module determines the abnormal data corresponding to the original data based on the graph data through the detection model; the second determination module determines the abnormal event corresponding to the abnormal data in the object to be detected based on the graph data through the construction model. Through the cooperation between the modules, based on the unified data model, the construction model and the detection model, the corresponding graph data is generated through the original data of the object to be detected, and the graph data is detected, so as to realize the detection of abnormalities of the object to be detected, determine the corresponding abnormal data, trace the abnormal events according to the abnormal data, and complete the practical application of multi-step detection of the object to be detected.

[0102] In one embodiment, the first determining module 330 is specifically configured to:

[0103] Clustering the graph data using the detection model to obtain multiple clusters;

[0104] Determine the cluster attributes of each cluster class by using the detection model, wherein the cluster attributes include normal labels and abnormal labels;

[0105] The detection model is used to determine the data in the cluster corresponding to the abnormal label as the abnormal data corresponding to the original data.

[0106] In one embodiment, the first determination module 330 includes a training operation of the detection model, specifically for:

[0107] Acquire a training set, wherein the training set includes historical sequence data and identification information corresponding to the historical sequence data after clustering, wherein the identification information includes a normal identification and an abnormal identification;

[0108] A clustering model is trained based on the training set to obtain a detection model.

[0109] In one embodiment, the second determining module 340 is specifically configured to:

[0110] Determine an initial graph node in the graph data corresponding to the abnormal data;

[0111] Taking the initial graph node as the source, along the relationship between nodes in the graph data, determine the intermediate node corresponding to the initial graph node, wherein the intermediate node is a graph node formed by the security basic data in the graph data;

[0112] The scenario formed by the object to be detected, the intermediate node and the initial graph node is determined as an abnormal event corresponding to the abnormal data in the object to be detected.

[0113] In one embodiment, the security basic data includes data of multiple preset topics, and the processing module 310 includes:

[0114] The conversion unit is used to convert the original data into security basic data according to the preset subject through a unified data model.

[0115] In one embodiment, the unified data model includes multiple sub-models, and the conversion unit is specifically used to:

[0116] Determine, by means of a unified data model, a sub-model corresponding to the data type of the original data in the unified data model;

[0117] The raw data is processed by the corresponding sub-model.

[0118] The abnormality determination device provided in the embodiment of the present invention can execute the abnormality determination method provided in any embodiment of the present invention, completes the determination of abnormal events through the mutual cooperation and collaboration between the modules, and has the functional modules and beneficial effects corresponding to the execution method.

[0119] Embodiment 4

[0120] According to an embodiment of the present invention, the present invention also provides an electronic device, a computer-readable storage medium and a computer program product.

[0121] Figure 4 It is a block diagram of an electronic device provided according to Embodiment 4 of the present invention, and the electronic device can implement the abnormal determination method described in the embodiment of the present invention. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workbenches, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0122] like Figure 4As shown, the electronic device 410 includes at least one processor 411, and a memory connected to the at least one processor 411 in communication, such as a read-only memory (ROM) 412, a random access memory (RAM) 413, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 411 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 412 or the computer program loaded from the storage unit 418 to the random access memory (RAM) 413. In the RAM 413, various programs and data required for the operation of the electronic device 410 can also be stored. The processor 411, the ROM 412, and the RAM 413 are connected to each other via a bus 414. An input / output (I / O) interface 415 is also connected to the bus 414.

[0123] A number of components in the electronic device are connected to the I / O interface 415, including: an input unit 416, such as a keyboard, a mouse, etc.; an output unit 417, such as various types of displays, speakers, etc.; a storage unit 418, such as a disk, an optical disk, etc.; and a communication unit 419, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 419 allows the electronic device to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0124] The processor 411 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 411 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The processor 411 performs the various methods and processes described above, such as an abnormality determination method.

[0125] In some embodiments, the abnormality determination method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 418. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 410 via the ROM 412 and / or the communication unit 419. When the computer program is loaded into the RAM 413 and executed by the processor 411, one or more steps of the abnormality determination method described above may be performed. Alternatively, in other embodiments, the processor 411 may be configured to perform the abnormality determination method in any other appropriate manner (e.g., by means of firmware).

[0126] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0127] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0128] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0129] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0130] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0131] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0132] In some embodiments, the computer program product includes a computer program, and when the computer program is executed by a processor, the abnormality determination method provided by the embodiment of the present invention is implemented.

[0133] The technical solution of the embodiment of the present invention, through an abnormality determination method, device, electronic device, storage medium and program product, processes the original data into security basic data through a unified data model, and transmits the security basic data to the security basic data domain; constructs graph data based on the security basic data in the security basic data domain and the mapping data corresponding to the security basic data through a construction model, and transmits the graph data to a detection model; through the detection model, based on the graph data, determines the abnormal data corresponding to the original data; through the construction model, based on the graph data, determines the abnormal event corresponding to the abnormal data in the object to be detected. Based on a unified data model, a construction model and a detection model, the present invention generates corresponding graph data through the original data of the object to be detected, detects the graph data, realizes the detection of abnormalities in the object to be detected, and determines the corresponding abnormal data, traces the abnormal events according to the abnormal data, and completes the practical application of multi-step detection of the object to be detected.

[0134] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0135] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for determining an abnormality, characterized in that: include: Processing the original data into security basic data through a unified data model, and transmitting the security basic data to a security basic data domain, wherein the original data includes data generated by an object to be detected, and the object to be detected includes a device in the power network that is at risk of being attacked; Building graph data by building a model based on the security basic data in the security basic data domain and the mapping data corresponding to the security basic data, and transmitting the graph data to the detection model; Determining, by means of the detection model and based on the graph data, abnormal data corresponding to the original data; The abnormal event corresponding to the abnormal data in the object to be detected is determined based on the graph data by constructing the model.

2. The method according to claim 1, characterized in that The determining, by the detection model and based on the graph data, abnormal data corresponding to the original data includes: Clustering the graph data using the detection model to obtain multiple clusters; Determine the cluster attributes of each cluster class by using the detection model, wherein the cluster attributes include normal labels and abnormal labels; The detection model is used to determine the data in the cluster corresponding to the abnormal label as the abnormal data corresponding to the original data.

3. The method according to claim 1, characterized in that The training operation of the detection model includes: Acquire a training set, wherein the training set includes historical sequence data and identification information corresponding to the historical sequence data after clustering, wherein the identification information includes a normal identification and an abnormal identification; A clustering model is trained based on the training set to obtain a detection model.

4. The method according to claim 1, characterized in that: The step of determining the abnormal event corresponding to the abnormal data in the object to be detected based on the graph data by constructing the model includes: Determine an initial graph node in the graph data corresponding to the abnormal data; Taking the initial graph node as the source, along the relationship between nodes in the graph data, determine the intermediate node corresponding to the initial graph node, wherein the intermediate node is a graph node formed by the security basic data in the graph data; The scenario formed by the object to be detected, the intermediate node and the initial graph node is determined as an abnormal event corresponding to the abnormal data in the object to be detected.

5. The method according to claim 1, characterized in that The security basic data includes data of multiple preset subjects, and the processing of the original data into the security basic data through a unified data model includes: Through a unified data model, the original data is converted into security basic data according to the preset subject.

6. The method according to claim 5, characterized in that The unified data model includes a plurality of sub-models, and the conversion of the original data into security basic data according to the preset subject through the unified data model includes: Determine, by means of a unified data model, a sub-model corresponding to the data type of the original data in the unified data model; The raw data is processed by the corresponding sub-model.

7. An abnormality determination device, characterized in that: include: A processing module, used to process the original data into security basic data through a unified data model, and transmit the security basic data to a security basic data domain, wherein the original data includes data generated by an object to be detected, and the object to be detected includes a device in the power network that is at risk of being attacked; A construction module, configured to construct graph data based on the security basic data in the security basic data domain and mapping data corresponding to the security basic data by constructing a model, and transmit the graph data to a detection model; A first determination module, configured to determine abnormal data corresponding to the original data based on the graph data by using the detection model; The second determination module is used to determine the abnormal event corresponding to the abnormal data in the object to be detected based on the graph data by using the constructed model.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can perform the abnormality determination method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the abnormality determination method according to any one of claims 1 to 6 when executed.

10. A computer program product, characterized in that The computer program product comprises a computer program, which, when executed by a processor, implements the abnormality determination method according to any one of claims 1 to 6.

Images