Service circulation method and system based on situation awareness, terminal and storage medium

Abstract

The invention discloses a business circulation method and system based on situation awareness, a terminal and a storage medium. The method comprises the following steps: screening out a detection server from a device group, obtaining collection data of other devices through the detection server, and identifying abnormal devices in the device group; standby equipment corresponding to the abnormal equipment is determined according to grouping label information of all the equipment, and the grouping label information is generated based on the working condition information and the service information; and transferring the business of the abnormal equipment to the standby equipment. According to the invention, the detection server is screened out from the equipment group without specially setting one detection server, so that the utilization rate of system resources can be improved. The abnormal equipment is identified through the detection server according to the collected data of the other equipment, and the equipment in the same group more adaptive to the business of the abnormal equipment is selected as the standby equipment according to the grouping label information of each piece of equipment, so that the business on the abnormal equipment is transferred in time, and the good operation of the business is ensured.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a business flow method, system, terminal and storage medium based on situation awareness. Background Art

[0002] Situational awareness is the perception of environmental elements within a certain time and space, and the understanding of the meaning of these elements, and ultimately predicting the future development status of these elements. Using big data analysis technology, situational awareness can classify and comprehensively analyze attack events, threat alerts, and attack sources, and improve the ability to discover, identify, understand, analyze, respond to, and deal with security threats from a global perspective.

[0003] The current situational awareness method mainly sets up a detection server to identify abnormal devices by analyzing the collected data of each device. In order to ensure the normal operation of various services of the system, after identifying abnormal devices that may be attacked, it is necessary to transfer the services of abnormal devices in a timely manner. The current service transfer method mainly randomly selects a device from normal devices to receive the services of abnormal devices. Although it can ensure the rapid transfer of services, it is difficult to ensure the compatibility between the selected device and the transferred services.

[0004] Therefore, the existing technology still needs to be improved and developed. Summary of the invention

[0005] The technical problem to be solved by the present invention is that, in view of the above-mentioned defects of the prior art, a business flow method, system, terminal and storage medium based on situational awareness are provided, aiming to solve the problem that the business transfer method in the prior art is to randomly select a device from normal devices to receive the business of abnormal devices. Although it can ensure the rapid transfer of the business, it is difficult to ensure the compatibility between the selected device and the transferred business.

[0006] The technical solution adopted by the present invention to solve the problem is as follows:

[0007] In a first aspect, an embodiment of the present invention provides a business flow method based on situational awareness, the method comprising:

[0008] Filter out a detection server from the device group, obtain collected data of the remaining devices through the detection server, and identify abnormal devices in the device group according to the collected data;

[0009] Acquire group label information of each device, and determine the backup device corresponding to the abnormal device according to the group label information of each device; wherein the group label information is generated based on the working condition information and the service information;

[0010] The business flow of the abnormal device is transferred to the backup device.

[0011] In one implementation, the step of identifying abnormal devices in the device group according to each of the collected data includes:

[0012] Classifying the collected data to obtain a plurality of data groups, wherein each of the data groups corresponds to a different data type;

[0013] For each of the data groups, all data contained in the data group are compared, and similar deviating data are identified through the comparison results to obtain horizontal analysis data;

[0014] For the collected data of each device, all data contained in the collected data are compared, and the deviating data of the same device are identified through the comparison results to obtain longitudinal analysis data;

[0015] Abnormal devices in the device group are identified according to the horizontal analysis data and the vertical analysis data.

[0016] In one implementation, the method for generating the grouping tag information includes:

[0017] Obtaining the operating condition information and service information corresponding to each device in the device group;

[0018] Inputting the working condition information and the service information of each device into a pre-established device grouping algorithm;

[0019] The device grouping algorithm is used to group the working condition information and the service information of each device, and the grouping label information corresponding to each device is generated according to the grouping result.

[0020] In one implementation, determining the backup device corresponding to the abnormal device according to the grouping label information of each device includes:

[0021] Filter out devices in the same group as the abnormal device according to the group label information to obtain a number of candidate backup devices;

[0022] Determine the number of spare devices according to the service information of the abnormal device;

[0023] For each candidate device, calculate the device idleness according to the working condition information of the candidate device, calculate the service similarity according to the service information of the candidate device and the abnormal device, and calculate the comprehensive score according to the device idleness and the service similarity;

[0024] The candidate devices are sorted according to the comprehensive scores, and a backup device is determined from the candidate devices according to the sorting result and the number of backup devices.

[0025] In one implementation, transferring the service flow of the abnormal device to the backup device includes:

[0026] Classify services according to the service information of the abnormal device to obtain a number of service sets of different categories;

[0027] Assess the risk level of the abnormal device and the security level corresponding to each of the service sets;

[0028] Determining a plurality of first service sets to be transferred according to the risk level of the abnormal device and the security level of each of the service sets;

[0029] The entire first service set is transferred to the standby device.

[0030] In one implementation, determining the first service sets to be transferred according to the risk level of the abnormal device and the security level of each service set includes:

[0031] For each of the service sets, determining whether the security level of the service set matches the risk level of the abnormal device;

[0032] If there is no match, the service set is used as the first service set to be transferred.

[0033] In one embodiment, the method further comprises:

[0034] Updating the risk level of the abnormal device in real time;

[0035] If the updated risk level is greater than the original risk level, then continuing to perform the step of determining the first plurality of service sets to be transferred according to the risk level of the abnormal device and the security level of each of the service sets according to the updated risk level and the remaining service sets that have not been transferred;

[0036] If the updated risk level is lower than the original risk level, several second service sets to be restored are determined according to the updated risk level and the transferred service sets; and all the second service sets are transferred back to the abnormal device.

[0037] In a second aspect, an embodiment of the present invention further provides a business flow system based on situational awareness, the system comprising:

[0038] A threat perception module, used to select a detection server from a device group, obtain the collected data of the remaining devices through the detection server, and identify abnormal devices in the device group according to the collected data;

[0039] An equipment selection module, used to obtain group label information of each equipment, and determine the backup equipment corresponding to the abnormal equipment according to the group label information of each equipment; wherein the group label information is generated based on the working condition information and the service information;

[0040] The service flow transfer module is used to transfer the service flow of the abnormal device to the backup device.

[0041] In a third aspect, an embodiment of the present invention further provides a terminal comprising a memory and at least one processor; the memory stores a program; the program includes instructions for executing a business flow method based on situational awareness as described in any one of the above; and the processor is used to execute the program.

[0042] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium on which a plurality of instructions are stored, wherein the instructions are suitable for being loaded and executed by a processor to implement the steps of any of the situational awareness-based business flow methods described above.

[0043] Beneficial effects of the present invention: The embodiment of the present invention selects a detection server from a device group, obtains the collected data of the remaining devices through the detection server, and identifies abnormal devices in the device group according to the collected data; obtains the grouping label information of each device, and determines the backup device corresponding to the abnormal device according to the grouping label information of each device; wherein the grouping label information is generated based on the working condition information and the service information; and transfers the service flow of the abnormal device to the backup device. The present invention selects a detection server from a device group without setting up a dedicated detection server, which can improve the utilization rate of system resources. The detection server identifies abnormal devices according to the collected data of the remaining devices, and selects the same group of devices that are more compatible with the services of the abnormal devices as backup devices according to the grouping label information of each device, so as to timely transfer the services on the abnormal devices and ensure the good operation of the services. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0045] Figure 1 It is a flowchart of a business flow method based on situational awareness provided by an embodiment of the present invention.

[0046] Figure 2 It is a schematic diagram of data integration provided by an embodiment of the present invention.

[0047] Figure 3 It is a schematic diagram of data dispersion provided by an embodiment of the present invention.

[0048] Figure 4 It is a schematic diagram of the functional modules of the detection server and agent provided in an embodiment of the present invention.

[0049] Figure 5 It is a schematic diagram of the internal modules of the business flow system based on situational awareness provided by an embodiment of the present invention.

[0050] Figure 6 It is a principle block diagram of a terminal provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0051] The present invention discloses a business flow method, system, terminal and storage medium based on situational awareness. In order to make the purpose, technical solution and effect of the present invention clearer and more specific, the present invention is further described in detail with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0052] It will be understood by those skilled in the art that, unless expressly stated, the singular forms "one", "said", and "the" used herein may also include plural forms. It should be further understood that the term "comprising" used in the specification of the present invention refers to the presence of the features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof. It should be understood that when we refer to an element as being "connected" or "coupled" to another element, it may be directly connected or coupled to the other element, or there may be intermediate elements. In addition, the "connection" or "coupling" used herein may include wireless connection or wireless coupling. The term "and / or" used herein includes all or any unit and all combinations of one or more associated listed items.

[0053] It will be understood by those skilled in the art that, unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as generally understood by those skilled in the art in the art to which the present invention belongs. It should also be understood that terms such as those defined in general dictionaries should be understood to have meanings consistent with the meanings in the context of the prior art, and will not be interpreted with idealized or overly formal meanings unless specifically defined as herein.

[0054] The current situational awareness method mainly sets up a detection server to identify abnormal devices by analyzing the collected data of each device. In order to ensure the normal operation of various services of the system, after identifying abnormal devices that may be attacked, it is necessary to transfer the services of abnormal devices in a timely manner. The current service transfer method mainly randomly selects a device from normal devices to receive the services of abnormal devices. Although it can ensure the rapid transfer of services, it is difficult to ensure the compatibility between the selected device and the transferred services.

[0055] In view of the above-mentioned defects of the prior art, the present invention provides a business flow method based on situational awareness, wherein the method selects a detection server from a device group, obtains the collected data of the remaining devices through the detection server, and identifies the abnormal devices in the device group according to the collected data; obtains the group label information of each device, and determines the backup device corresponding to the abnormal device according to the group label information of each device; wherein the group label information is generated based on the working condition information and the business information; and transfers the business flow of the abnormal device to the backup device. The present invention selects a detection server from a device group, and there is no need to set up a detection server specifically, which can improve the utilization rate of system resources. The detection server identifies the abnormal device according to the collected data of the remaining devices, and selects the same group of devices that are more compatible with the business of the abnormal device as the backup device according to the group label information of each device, so as to timely transfer the business on the abnormal device and ensure the good operation of the business.

[0056] like Figure 1 As shown, the method includes:

[0057] Step S100: Filter out a detection server from the device group, obtain collected data of other devices through the detection server, and identify abnormal devices in the device group according to the collected data.

[0058] Specifically, a network that needs to be situationally aware or monitored is determined in advance, and all devices or important parts of the devices are selected to form a specific device group. In order to improve the utilization rate of system resources, this embodiment does not set up an additional device as a detection server, but screens out one or more idle devices as detection servers by analyzing the status and / or service priority of each device in the device group. The remaining devices act as agents to perform local data collection tasks. The detection server is responsible for managing and coordinating the data collection process of the remaining devices. The detection server will first arrange and issue the collection instructions of each device. Among them, in the initial stage, a pre-set basic collection instruction can be issued, and the collection instruction can also be arranged and issued based on a specific computing task. After each device receives the collection instruction, it will perform the corresponding data collection task according to the collection instruction and report the collected data to the detection server. The detection server can identify devices with abnormal status by comparing and analyzing the collected data of each device. Abnormal devices have certain security risks and need to be monitored and processed in a timely manner.

[0059] In one implementation, the step of identifying abnormal devices in the device group according to each of the collected data includes:

[0060] Classifying the collected data to obtain a plurality of data groups, wherein each of the data groups corresponds to a different data type;

[0061] For each of the data groups, all data contained in the data group are compared, and similar deviating data are identified through the comparison results to obtain horizontal analysis data;

[0062] For the collected data of each device, all data contained in the collected data are compared, and the deviating data of the same device are identified through the comparison results to obtain longitudinal analysis data;

[0063] Abnormal devices in the device group are identified according to the horizontal analysis data and the vertical analysis data.

[0064] Specifically, this embodiment performs data analysis tasks from two dimensions: horizontal analysis and vertical analysis. Horizontal analysis refers to comparing and analyzing the same type of data collected by multiple devices, and vertical analysis refers to comparing and analyzing multiple types of data collected by the same device.

[0065] For horizontal analysis: First, classify the collected data of each device. The purpose of classification is to group the same / similar types of data into one group for subsequent processing and analysis. The classification standard can be determined based on one or more characteristics such as the source, type, format, and purpose of the data. Each group of data obtained after classification becomes a data group. Each data group contains data of the same data type from different devices. Different data groups correspond to different data types, such as temperature data, function data, CPU data, memory data, etc. (such as Figure 2 As shown). For each data group, all data contained in the data group are compared. The purpose of the comparison is to identify data that is significantly different from other data, and define such deviating data as similar deviating data. The horizontal analysis results are obtained based on all similar deviating data. In practical applications, the comparison process of the horizontal analysis can adopt one or more comparison methods, such as statistical analysis methods and machine learning algorithms. Taking the statistical analysis method as an example, the mean and / or standard deviation can be used to identify data that deviates from the normal range.

[0066] For longitudinal analysis: the collected data of each device is analyzed independently, rather than mixing the collected data of multiple devices. For each device, all the collected data are compared internally to identify the data that is significantly different from the generation / change trend of other data of the device, and such deviation data is defined as same-device deviation data. The longitudinal analysis results are obtained based on all the same-device deviation data. In actual applications, the comparison process of longitudinal analysis can adopt one or more comparison methods, such as statistical analysis methods, time series analysis methods, and machine learning algorithms.

[0067] In one implementation, when there is only one detection server, it indicates that a single device detection mode is currently used, that is, all data groups are sent to one device for data analysis (e.g. Figure 2 When there are multiple detection servers, it means that the distributed detection mode is currently adopted, that is, multiple data groups can be sent to multiple devices for data analysis. Devices with more computing resources are allocated more data groups, and devices with less computing resources are allocated fewer data groups (such as Figure 3 In actual application, a detection server can be selected first, and then the detection module of the detection server can further determine whether more detection servers are needed to collaborate in data analysis.

[0068] Step S200: Acquire group label information of each device, and determine the backup device corresponding to the abnormal device according to the group label information of each device; wherein the group label information is generated based on working condition information and business information.

[0069] Specifically, operating condition information refers to the working conditions and / or operating environment of the equipment, which may include factors such as the equipment's operating time, load conditions, ambient temperature and humidity. Business information refers to the business processes or application scenarios supported by the equipment. For example, some equipment may be specifically used for R&D testing, while other equipment may be used for customer service. Different types of services may have different performance requirements for equipment. In actual application, all devices in the device group will first be grouped according to the operating condition information and business information, and the grouping label information of each device will be determined based on the grouping results. The grouping label information will be stored in each device, but it will only be used by the device that serves as the analysis server. After identifying the abnormal device, you can preferentially select a backup device from the same group of devices.

[0070] In one implementation, the method for generating group label information includes:

[0071] Obtaining the operating condition information and service information corresponding to each device in the device group;

[0072] Inputting the working condition information and the service information of each device into a pre-established device grouping algorithm;

[0073] The device grouping algorithm is used to group the working condition information and the service information of each device, and the grouping label information corresponding to each device is generated according to the grouping result.

[0074] Specifically, Figure 4 As shown, the detection server includes a data grouping module and a detection module, wherein the data grouping module is used to generate and / or store the grouping label information of each device, and the detection module is used to perform data analysis on the collected data of each device to identify abnormal devices. In actual application scenarios, in order to facilitate rapid device grouping, a device grouping algorithm can be pre-built, through which the working condition similarity and business similarity between two devices are automatically calculated, and the devices are grouped based on the working condition similarity and business similarity, so that devices with similar working conditions and similar business types are grouped into the same group, and devices with different working conditions and different business types are grouped into different groups, thereby obtaining multiple device groups.

[0075] In one implementation, the functional modules inside the detection server include but are not limited to: detection module, data management module, orchestration module, instruction management module and communication module. Among them, the orchestration module is mainly used to implement functions such as task parsing, instruction orchestration, and instruction calling; the instruction management module is mainly used to implement functions such as instruction generation and instruction issuance; the detection module is mainly used to determine the currently adopted detection mode; the data management module is mainly used for equipment grouping (grouping according to equipment working conditions, functions, and services to better perform data comparison and data analysis), data routing, and instruction issuance.

[0076] In one implementation, the functional modules inside the agent (other devices except the detection server) include but are not limited to: a communication module, an instruction module, a response module, a collection probe module, and a management module. Among them, the instruction module is mainly used for instruction parsing and distribution and execution of instructions; the collection probe module is mainly used for data collection. Data probe types include but are not limited to: system information probes, which are used to collect information about the current system operating environment; performance probes, which are used to collect information related to the utilization rate of system resources, such as CPU, memory, disk, etc.; network probes, which are used to collect network data packet information. Since the operating system corresponding to each device may be different, the data probes that can be supported by each device may also be different.

[0077] In one implementation, determining the backup device corresponding to the abnormal device according to the group label information of each device includes:

[0078] Filter out devices in the same group as the abnormal device according to the group label information to obtain a number of candidate backup devices;

[0079] Determine the number of spare devices according to the service information of the abnormal device;

[0080] For each candidate device, calculate the device idleness according to the working condition information of the candidate device, calculate the service similarity according to the service information of the candidate device and the abnormal device, and calculate the comprehensive score according to the device idleness and the service similarity;

[0081] The candidate devices are sorted according to the comprehensive scores, and a backup device is determined from the candidate devices according to the sorting result and the number of backup devices.

[0082] Specifically, when selecting the backup device corresponding to the abnormal device, this embodiment will go through two rounds of device screening, one round of screening based on grouping, and the other round of screening based on working conditions and business. In actual application scenarios, when a device is identified as an abnormal device, it is first necessary to check the group to which the device belongs, and then select other normal devices from the group, and use these selected devices as preliminary candidate devices. Then analyze the current business information of the abnormal device, such as the current business volume, the importance and / or urgency of the business, and determine how many backup devices are needed to take over the business of the abnormal device through the analysis results to ensure that the business is not affected or the impact is minimized. For each candidate device, first, it is necessary to examine its current workload through the working condition information of the candidate device, calculate the proportion of idle resources that can be used to take over the new business, and use the device idleness as a quantitative indicator of the calculation result. Secondly, it is necessary to examine the adaptability of the candidate device to the business to be taken over through the business information of the candidate device and the abnormal device, such as the adaptability in terms of business type, data format, interface compatibility, etc., and use the business similarity as a quantitative indicator of the comparison result. Finally, a comprehensive score is assigned to each candidate device based on the device idleness and service similarity. The first several candidate devices with the highest comprehensive scores are more suitable to be selected as backup devices to take over the services of abnormal devices.

[0083] Step S300: transfer the service flow of the abnormal device to the backup device.

[0084] Specifically, in order to ensure data security and normal business operations, this embodiment needs to take suppression or blocking measures against abnormal devices, and promptly transfer important businesses on abnormal devices to backup devices with similar business operations and idle computing resources, and isolate abnormal devices from other normal devices, thereby ensuring safe and uninterrupted operation of device businesses. After the abnormal device returns to normal / the risk is eliminated, the transferred business flow is transferred back to the original device.

[0085] In one implementation, transferring the service flow of the abnormal device to the backup device includes:

[0086] Classify services according to the service information of the abnormal device to obtain a number of service sets of different categories;

[0087] Assess the risk level of the abnormal device and the security level corresponding to each of the service sets;

[0088] Determining a plurality of first service sets to be transferred according to the risk level of the abnormal device and the security level of each of the service sets;

[0089] The entire first service set is transferred to the standby device.

[0090] Specifically, this embodiment needs to first evaluate the risk level of abnormal devices and the security level of each service set to accurately determine which services to transfer. For abnormal devices, a risk assessment model can be pre-built, and the risk assessment model accurately assesses the risk level of abnormal devices based on factors such as the abnormality of the collected data of the device, the current device status, and the frequency of failures. The risk level can be divided into multiple levels, such as low risk, medium risk, and high risk, and each level corresponds to a different processing strategy. For the service set, the operation and maintenance personnel can pre-evaluate the security level of each service set, or pre-build a security assessment model, and the security assessment model automatically evaluates the security level of each service set based on the importance of the service, the confidentiality of the interactive information, and the degree of impact on the system. The security level can be divided into multiple levels, such as low security, medium security, and high security, and each level corresponds to different protection measures or circulation strategies. By comparing the risk level of the abnormal device and the security level of each service set, the service set that needs to be transferred in time can be correctly screened out, that is, the first service set is obtained. The backup device can take over these first service sets to ensure that the corresponding services can operate normally.

[0091] In one implementation, a specific transfer strategy can be determined based on all first service sets to be transferred, including but not limited to data migration, service switching and other strategies. In addition, an automated tool can be used to execute the service transfer process to reduce human errors and improve service transfer efficiency. In addition, during the service transfer process and / or after the service transfer is completed, the operating status of each first service set and the performance of the standby device can be monitored in real time, and a corresponding feedback mechanism can be established to timely discover and handle problems.

[0092] In one implementation, determining the first service sets to be transferred according to the risk level of the abnormal device and the security level of each service set includes:

[0093] For each of the service sets, determining whether the security level of the service set matches the risk level of the abnormal device;

[0094] If there is no match, the service set is used as the first service set to be transferred.

[0095] Specifically, a correspondence can be pre-set to match the risk level of the abnormal device and the security level of the service set. The correspondence covers the security levels of services that can guarantee normal operation corresponding to various risk levels. In actual application scenarios, for each service set, based on the current risk level of the abnormal device and the pre-set correspondence, it is determined whether the service set belongs to the security level that can guarantee normal operation under the risk level. If not, the service set is used as the first service set. If the number of screened first service sets is too large, all first service sets can be prioritized to ensure that important service sets can be transferred first.

[0096] In one implementation, the method further includes:

[0097] Updating the risk level of the abnormal device in real time;

[0098] If the updated risk level is greater than the original risk level, then continuing to perform the step of determining the first plurality of service sets to be transferred according to the risk level of the abnormal device and the security level of each of the service sets according to the updated risk level and the remaining service sets that have not been transferred;

[0099] If the updated risk level is lower than the original risk level, several second service sets to be restored are determined according to the updated risk level and the transferred service sets; and all the second service sets are transferred back to the abnormal device.

[0100] Specifically, after the business transfer is completed, it is also necessary to conduct real-time risk monitoring and assessment of abnormal devices to ensure the timeliness of their risk levels, and then ensure that business transfer measures can respond to new risk changes in a timely manner. In actual application scenarios, if the updated risk level is higher than the original risk level, it means that the potential threat of abnormal devices is increasing, and it is necessary to re-compare the security level of the remaining business sets of the machine according to the updated risk level to determine whether the remaining business sets need to be transferred as soon as possible; if the updated risk level is lower than the original risk level, it means that the threat of abnormal devices has been reduced, and the security level of the transferred business sets can be re-compare according to the updated risk level to determine whether the transferred business sets are suitable for transfer back to the machine to reduce the business load of other devices. The technical solution of this embodiment can be used in conjunction with the Hongmeng (kaihongOS) system.

[0101] Based on the above embodiments, the present invention also provides a business flow system based on situational awareness, such as Figure 5 As shown, the system comprises:

[0102] Threat perception module 01, used to select a detection server from a device group, obtain the collected data of the remaining devices through the detection server, and identify abnormal devices in the device group according to the collected data;

[0103] The device selection module 02 is used to obtain the grouping label information of each device, and determine the backup device corresponding to the abnormal device according to the grouping label information of each device; wherein the grouping label information is generated based on the working condition information and the service information;

[0104] The service flow transfer module 03 is used to transfer the service flow of the abnormal device to the backup device.

[0105] In one implementation, the threat perception module 01 includes:

[0106] A data classification unit, used for classifying the collected data to obtain a plurality of data groups; wherein each of the data groups corresponds to a different data type;

[0107] A horizontal analysis unit, for comparing all data contained in each data group, identifying similar deviating data through the comparison results, and obtaining horizontal analysis data;

[0108] A longitudinal analysis unit, for comparing all data contained in the collected data of each device, identifying deviating data of the same device through the comparison result, and obtaining longitudinal analysis data;

[0109] A comprehensive analysis unit is used to identify abnormal devices in the device group according to the horizontal analysis data and the vertical analysis data.

[0110] In one implementation, the system further includes a label generation module, wherein the label generation module is configured to:

[0111] Obtaining the operating condition information and service information corresponding to each device in the device group;

[0112] Inputting the working condition information and the service information of each device into a pre-established device grouping algorithm;

[0113] The device grouping algorithm is used to group the working condition information and the service information of each device, and the grouping label information corresponding to each device is generated according to the grouping result.

[0114] In one implementation, the device selection module 02 includes:

[0115] A device initial screening unit, used to screen out devices in the same group as the abnormal device according to the group label information, and obtain a number of candidate backup devices;

[0116] A quantity determination unit, used to determine the quantity of spare devices according to the service information of the abnormal device;

[0117] A device scoring unit, configured to calculate, for each candidate device, a device idleness according to the working condition information of the candidate device, calculate a service similarity according to the service information of the candidate device and the abnormal device, and calculate a comprehensive score according to the device idleness and the service similarity;

[0118] A device sorting unit is used to sort the candidate devices according to the comprehensive scores, and determine a spare device from the candidate devices according to the sorting result and the number of spare devices.

[0119] In one implementation, the business flow module 03 includes:

[0120] A service classification unit, configured to classify services according to the service information of the abnormal device to obtain a plurality of service sets of different categories;

[0121] A level assessment unit, used to assess the risk level of the abnormal device and assess the security level corresponding to each of the service sets;

[0122] A service screening unit, configured to determine a plurality of first service sets to be transferred according to the risk level of the abnormal device and the security level of each of the service sets;

[0123] The service transfer unit is used to transfer all the first service sets to the standby device.

[0124] In one implementation, the service screening unit is specifically used to:

[0125] For each of the service sets, determining whether the security level of the service set matches the risk level of the abnormal device;

[0126] If there is no match, the service set is used as the first service set to be transferred.

[0127] In one implementation, the system further includes a service recovery module, and the service recovery module is used to:

[0128] Updating the risk level of the abnormal device in real time;

[0129] If the updated risk level is greater than the original risk level, then continuing to perform the step of determining the first plurality of service sets to be transferred according to the risk level of the abnormal device and the security level of each of the service sets according to the updated risk level and the remaining service sets that have not been transferred;

[0130] If the updated risk level is lower than the original risk level, several second service sets to be restored are determined according to the updated risk level and the transferred service sets; and all the second service sets are transferred back to the abnormal device.

[0131] Based on the above embodiment, the present invention further provides a terminal, whose principle block diagram can be shown as follows: Figure 6 As shown. The terminal includes a processor, a memory, a network interface, and a display screen connected through a system bus. Among them, the processor of the terminal is used to provide computing and control capabilities. The memory of the terminal includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the terminal is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a business flow method based on situational awareness is implemented:

[0132] Filter out a detection server from the device group, obtain collected data of the remaining devices through the detection server, and identify abnormal devices in the device group according to the collected data;

[0133] Acquire group label information of each device, and determine the backup device corresponding to the abnormal device according to the group label information of each device; wherein the group label information is generated based on the working condition information and the service information;

[0134] The business flow of the abnormal device is transferred to the backup device.

[0135] The display screen of the terminal may be a liquid crystal display screen or an electronic ink display screen.

[0136] Those skilled in the art will understand that Figure 6 The principle block diagram shown in the figure is only a block diagram of a partial structure related to the scheme of the present invention, and does not constitute a limitation on the terminal to which the scheme of the present invention is applied. The specific terminal may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0137] In one implementation, the memory of the terminal stores one or more programs, and is configured to be executed by one or more processors. The one or more programs include instructions for performing a business flow method based on situational awareness:

[0138] Filter out a detection server from the device group, obtain collected data of the remaining devices through the detection server, and identify abnormal devices in the device group according to the collected data;

[0139] Acquire group label information of each device, and determine the backup device corresponding to the abnormal device according to the group label information of each device; wherein the group label information is generated based on the working condition information and the service information;

[0140] The business flow of the abnormal device is transferred to the backup device.

[0141] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Any reference to memory, storage, database or other media used in the embodiments provided by the present invention can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0142] In summary, the present invention discloses a business flow method, system, terminal and storage medium based on situational awareness. By screening out a detection server from a device group, the detection server obtains the collected data of the remaining devices, and identifies the abnormal devices in the device group according to the collected data; obtains the group label information of each device, and determines the backup device corresponding to the abnormal device according to the group label information of each device; the group label information is generated based on the working condition information and business information; and the business flow of the abnormal device is transferred to the backup device. The present invention screens out a detection server from a device group, and there is no need to set up a detection server specifically, which can improve the utilization rate of system resources. The detection server identifies the abnormal device according to the collected data of each device, and selects the same group of devices that are more compatible with the business of the abnormal device as the backup device according to the group label information of each device, so as to transfer the business on the abnormal device in time and ensure the good operation of the business.

[0143] It should be understood that the application of the present invention is not limited to the above examples. For ordinary technicians in this field, improvements or changes can be made based on the above description. All these improvements and changes should fall within the scope of protection of the claims attached to the present invention.

Claims

1. A business flow method based on situational awareness, characterized in that: The method comprises: Filter out a detection server from the device group, obtain collected data of the remaining devices through the detection server, and identify abnormal devices in the device group according to the collected data; Acquire group label information of each device, and determine the backup device corresponding to the abnormal device according to the group label information of each device; wherein the group label information is generated based on the working condition information and the service information; The business flow of the abnormal device is transferred to the backup device.

2. The business flow method based on situational awareness according to claim 1 is characterized in that: The step of identifying abnormal devices in the device group according to each of the collected data includes: Classifying the collected data to obtain a plurality of data groups, wherein each of the data groups corresponds to a different data type; For each of the data groups, all data contained in the data group are compared, and similar deviating data are identified through the comparison results to obtain horizontal analysis data; For the collected data of each device, all data contained in the collected data are compared, and the deviating data of the same device are identified through the comparison results to obtain longitudinal analysis data; Abnormal devices in the device group are identified according to the horizontal analysis data and the vertical analysis data.

3. The business flow method based on situational awareness according to claim 1 is characterized in that: The method for generating the grouping label information comprises: Obtaining the operating condition information and service information corresponding to each device in the device group; Inputting the working condition information and the service information of each device into a pre-established device grouping algorithm; The device grouping algorithm is used to group the working condition information and the service information of each device, and the grouping label information corresponding to each device is generated according to the grouping result.

4. The business flow method based on situational awareness according to claim 1 is characterized in that: The determining, according to the grouping label information of each device, a standby device corresponding to the abnormal device includes: Filter out devices in the same group as the abnormal device according to the group label information to obtain a number of candidate backup devices; Determine the number of spare devices according to the service information of the abnormal device; For each candidate device, calculate the device idleness according to the working condition information of the candidate device, calculate the service similarity according to the service information of the candidate device and the abnormal device, and calculate the comprehensive score according to the device idleness and the service similarity; The candidate devices are sorted according to the comprehensive scores, and a backup device is determined from the candidate devices according to the sorting result and the number of backup devices.

5. The business flow method based on situational awareness according to claim 4 is characterized in that: The transferring the service flow of the abnormal device to the backup device includes: Classify services according to the service information of the abnormal device to obtain a number of service sets of different categories; Assess the risk level of the abnormal device and the security level corresponding to each of the service sets; Determining a plurality of first service sets to be transferred according to the risk level of the abnormal device and the security level of each of the service sets; The entire first service set is transferred to the standby device.

6. The business flow method based on situational awareness according to claim 5 is characterized in that: The determining of a plurality of first service sets to be transferred according to the risk level of the abnormal device and the security level of each of the service sets includes: For each of the service sets, determining whether the security level of the service set matches the risk level of the abnormal device; If there is no match, the service set is used as the first service set to be transferred.

7. The business flow method based on situational awareness according to claim 5 is characterized in that: The method further comprises: Updating the risk level of the abnormal device in real time; If the updated risk level is greater than the original risk level, then continuing to perform the step of determining the first plurality of service sets to be transferred according to the risk level of the abnormal device and the security level of each of the service sets according to the updated risk level and the remaining service sets that have not been transferred; If the updated risk level is lower than the original risk level, several second service sets to be restored are determined according to the updated risk level and the transferred service sets; and all the second service sets are transferred back to the abnormal device.

8. A business flow system based on situational awareness, characterized in that: The system comprises: A threat perception module, used to select a detection server from a device group, obtain the collected data of the remaining devices through the detection server, and identify abnormal devices in the device group according to the collected data; An equipment selection module, used to obtain group label information of each equipment, and determine the backup equipment corresponding to the abnormal equipment according to the group label information of each equipment; wherein the group label information is generated based on the working condition information and the service information; The service flow transfer module is used to transfer the service flow of the abnormal device to the backup device.

9. A terminal, characterized in that: The terminal includes a memory and at least one processor; the memory stores a program; the program contains instructions for executing the business flow method based on situational awareness as described in any one of claims 1-7; and the processor is used to execute the program.

10. A computer-readable storage medium having a plurality of instructions stored thereon, characterized in that: The instructions are suitable for being loaded and executed by a processor to implement the steps of the business flow method based on situational awareness as described in any one of claims 1-7.

Images