Potential safety hazard sensing method and device, electronic equipment and storage medium

Abstract

The invention discloses a potential safety hazard sensing method and device, electronic equipment and a storage medium, belongs to the technical field of network security, and is used for improving the security of network equipment. The method comprises the steps that user perception is scored through a poor quality index, a user perception score is obtained, and the poor quality index comprises user perception and a packet loss rate / jamming rate; and when the user perception score is greater than the preset threshold, the first potential safety hazard perception is performed through the poor quality prediction formula, so that the potential safety hazard can be perceived, and the security of the network equipment is improved.

Description

Technical Field

[0001] The present application belongs to the field of network security technology, and specifically relates to a security risk perception method, device, electronic device and storage medium. Background Art

[0002] For the operator's operation and maintenance guarantee system, there are two main means of guaranteeing network equipment. The first is post-event maintenance, that is, after a serious failure occurs and has affected the user's service experience, the technicians will be informed and rush to the site to quickly repair the failure. The other is preventive maintenance, that is, through regular maintenance by initial personnel, periodic abnormality detection and dispatch maintenance, the occurrence of failures can be reduced, or early intervention can be carried out before a major failure occurs.

[0003] However, the above-mentioned operation and maintenance guarantees only achieve the traditional ecological closed loop of fault discovery, fault diagnosis, and fault repair, which can only meet the basic needs of network equipment operation and maintenance and solve the problem of rapid repair of faults that have occurred. It is impossible to prevent the occurrence of faults, ensure that network equipment is maintained in a stable and monitored operating state as much as possible, and cannot perceive potential faults that have not yet occurred in advance. Summary of the invention

[0004] The embodiments of the present application provide a safety hazard perception method, device, electronic device and storage medium, which can solve the problem that potential faults that have not yet occurred cannot be perceived in advance.

[0005] In a first aspect, an embodiment of the present application provides a method for perceiving security risks, the method comprising: scoring user perception through a quality difference indicator to obtain a user perception score, the quality difference indicator comprising user perception and packet loss rate / stuttering rate; when the user perception score is greater than a preset threshold, performing a first security risk perception through a quality difference prediction formula.

[0006] In the second aspect, an embodiment of the present application provides a security hazard perception device, which includes: a processing module, used to score user perception through a quality difference indicator to obtain a user perception score, the quality difference indicator including user perception and packet loss rate / stuttering rate; a perception module, used to perform a first security hazard perception through a quality difference prediction formula when the user perception score is greater than a preset threshold.

[0007] In a third aspect, an embodiment of the present application provides an electronic device, which includes a processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein the program or instruction, when executed by the processor, implements the steps of the method described in the first aspect.

[0008] In a fourth aspect, an embodiment of the present application provides a readable storage medium, on which a program or instruction is stored, and when the program or instruction is executed by a processor, the steps of the method described in the first aspect are implemented.

[0009] In an embodiment of the present application, user perception is scored by a quality difference indicator to obtain a user perception score, and the quality difference indicator includes user perception and packet loss rate / stuttering rate; when the user perception score is greater than a preset threshold, a first security risk perception is performed through a quality difference prediction formula, which can perceive security risks and improve the security of network equipment. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] Figure 1 It is a flowchart of a method for perceiving potential safety hazards provided in an embodiment of the present application; Figure 2 This is a schematic diagram of OLT device service association provided by an embodiment of the present application; Figure 3 It is a structural schematic diagram of a safety hazard sensing device provided in an embodiment of the present application; Figure 4 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0011] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0012] The terms "first", "second", etc. in the specification and claims of the present application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable under appropriate circumstances, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally of one type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" in the specification and claims represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0013] The following, in conjunction with the accompanying drawings, describes in detail the safety hazard perception method, device, electronic device and storage medium provided in the embodiments of the present application through specific embodiments and their application scenarios.

[0014] Figure 1A method for perceiving security risks provided by an embodiment of the present application is shown. The method can be executed by an electronic device, and the electronic device may include: a server and / or a network device. In other words, the method can be executed by software or hardware installed in the electronic device, and the method includes the following steps: Step 102: Score the user perception using the quality difference index to obtain a user perception score.

[0015] Specifically, in the hidden danger prediction and perception scenario of network equipment or OLT network equipment, the network equipment is an important local equipment, which is mainly used to realize the control, management, ranging and other functions of the optical network unit ONU of the user terminal equipment. Figure 2 As shown in the figure, from the perspective of network service structure, OLT undertakes various upstream tasks such as the Internet and network TV, and is connected to each user terminal that uses network services, including individual users or corporate users. Therefore, for operators, the operation and maintenance of OLT equipment occupies a very important position in the operation and maintenance of network equipment. The health of OLT equipment is directly related to the perception of downstream users when using network services.

[0016] In the operation and maintenance of network equipment or OLT equipment, the quality difference index is used to score the user perception of network services. The two quality difference indicators, user perception and packet loss rate / stuttering rate, are used to score. The higher the score, the worse the user perception. When users under the network equipment have large-scale quality difference, the network equipment may be faulty and need to be repaired. The performance in data distribution is usually that the user perception index exceeds the alarm value. In one implementation, the scoring of user perception by quality difference indicators includes: scoring according to the percentage of data whose user perception time exceeds a preset time and whose network delay does not exceed the preset time in the alarm data; scoring according to the ratio of the packet loss rate / stuttering rate in a preset time period to the historical average packet loss rate / stuttering rate trend line in the preset time period.

[0017] Specifically, the user perception score is scored based on the percentage of data whose user perception time exceeds a preset time and whose network delay does not exceed a preset time in the alarm data. The preset time can be set according to actual needs. In one embodiment, through log data analysis, the percentage of data whose user perception time exceeds 100 milliseconds and whose network delay does not exceed 100 milliseconds in the total alarm data determines the score. For every 10% of the score, 1 point is added. The higher the score, the worse the user perception.

[0018] Specifically, the packet loss rate / jam rate score is scored according to the ratio of the packet loss rate / jam rate in a preset time period to the historical average packet loss rate / jam rate trend line in the preset time period. In one embodiment, through log data analysis, the proportion of the packet loss rate / jam rate in a period of time above the historical average packet loss rate / jam rate trend line accounts for the proportion of the total in the time period, and 1 point is added for every 10%. The higher the score, the worse the user perception.

[0019] Step 104: When the user perception score is greater than a preset threshold, a first safety hazard perception is performed using a quality difference prediction formula.

[0020] Specifically, when the user perception score is greater than the preset threshold, it means that the network equipment may have poor user perception in the future, which is a great hidden danger for the network equipment operation and maintenance guarantee system. Therefore, before the failure occurs, the first hidden danger perception can be carried out through the quality difference prediction formula, so as to achieve pre-perception of hidden dangers and proactive intervention, which can greatly reduce the probability of LT failure and further reduce the significant economic losses caused by large-scale failures.

[0021] The quality difference prediction formula is as follows: X(k+1)=X(k)×P Among them, X(k) represents the state vector of the trend analysis and prediction object at time t=k, P represents the one-step transition probability matrix, and X(k+1) represents the state vector of the trend analysis and prediction object at time t=k+1.

[0022] The predicted probability of poor quality in the previous period is [0.3, 0.7]; The probability of the quality difference prediction becoming stronger in the current period is [0.6, 0.4]; The probability of poor quality prediction weakening transfer in the current period is [0.3, 0.7]; The probability of quality difference prediction transfer in the next period: 0.3x0.4+7x0.7=0.61; The predicted probability of quality difference transfer in the next period is: 0.3x0.4+7x0.7=0.61.

[0023] The security hazard perception method provided in the embodiment of the present application scores user perception through a quality difference index to obtain a user perception score, wherein the quality difference index includes user perception and packet loss rate / stuttering rate; when the user perception score is greater than a preset threshold, a first security hazard perception is performed through a quality difference prediction formula, and security hazards can be perceived, and potential hazard failures can be perceived in advance and actively intervened, which can greatly reduce the probability of failures, further reduce the significant economic losses caused by large-scale failures, and improve the security of network equipment.

[0024] In one implementation, when the user perception score is greater than a preset threshold, after the security risk perception is performed through the quality difference prediction formula, it also includes: determining the core application service topology based on the association relationship between the log service application database, the core application service topology includes the relationship between different servers, the server and the database, the middleware, the server core processor, the memory, the disk, and the process; obtaining topology data based on the core application service topology from the log of each service, the topology data includes operation monitoring data between different servers, the server and the database, the middleware, the server core processor, the memory, the disk, and the process; and performing comprehensive security risk perception based on the topology data and a preset large model.

[0025] In the embodiment of the present application, log stratification technology is used to increase the correlation data of training samples to solve the sample imbalance problem. Specifically, the log correlation relationship parameters are also used as dynamic parameters of the ChatGPT large language model to participate in the calculation.

[0026] First, in order to prevent the situation where the amount of daily log data in some large systems that provide global services may reach tens of tB (TBs), the log server divides the received data into two layers of analysis. At the first layer, we use the associations in the log service application database (database, middleware, server basic monitoring indicators) to mine the core application service topology and associate it with the network topology. The core application service topology records the relationships between different servers, databases, middleware, server CPUs, memories, disks, and processes. At the second layer, we mine a data set based on the first-layer core application service topology relationships from the logs of each service, called topology data. These topology data record the monitoring data and operating health status between servers and servers, databases, middleware, server core processors (CPUs), memories, disks, and processes in different time dimensions. Comprehensive security risk perception can be performed based on the topology data and the preset large model. In one implementation, the comprehensive safety hazard perception based on the topological data and the preset large model includes: performing a second safety hazard perception based on the topological data and the large model; and performing comprehensive safety hazard perception based on the results of the first safety hazard perception and the results of the second safety hazard perception.

[0027] Specifically, after obtaining the topological data, the second security risk perception can be performed based on the topological data and the preset large model. Finally, comprehensive security risk perception is performed based on the results of the first security risk perception and the second security risk perception. The security of network equipment is improved, the security of network equipment is improved, and the problem of sample imbalance is solved through the topological data.

[0028] In one implementation, the second safety hazard perception is performed based on the topological data and the preset large model, including: performing operation filtering on the operation monitoring data through an importance assessment algorithm, filtering out abnormal diagnosis monitoring data, and obtaining abnormal fluctuation data in the monitoring data; and performing the second safety hazard perception through the abnormal fluctuation data and the large model.

[0029] Specifically, in view of the current situation where data quality fluctuations are relatively small, the ChatGPT large language model is used throughout the process for the poor quality data with fewer features to solve the problem of fewer features. The operation monitoring data is filtered by the importance evaluation algorithm to filter out the abnormal diagnosis monitoring data and obtain the abnormal fluctuation data in the monitoring data; the second safety hazard perception is performed through the abnormal fluctuation data and the large model.

[0030] Specifically, the workflow of the large model is as follows: the large model mainly completes data labeling and analysis by operating ChatGPT's vector database. The vector database stores ChatGPT's conversation records. ChatGPT reads the records in the vector database and uses the importance evaluation algorithm in the context to complete the calculation tasks in an orderly manner.

[0031] The isolation layer of the large model is mainly started before starting the task. It will clear the vector database in ChatGPT to prevent the historical records generated by the previous tasks from disrupting the task execution of ChatGPT.

[0032] The identity layer of the model mainly writes identity recognition guidance sentences into the vector database. The large language model can generate identity recognition by reading the identity recognition guidance sentences in the vector database, thereby improving the accuracy of task processing. At the same time, the preset program automatically processes or manually processes the large model calculation results according to user permissions.

[0033] The instruction layer of the large model is to write the instructions of the task in the vector database, which mainly includes the operations that ChatGPT needs to perform and the form of the answer output. ChatGPT will read the instructions in the vector database and perform related operations according to the instructions.

[0034] In one embodiment, after the second safety hazard perception is performed through the abnormal fluctuation data and the large model, it also includes: writing the input abnormal fluctuation data and the result of the second safety hazard perception into a vector database through the large model.

[0035] Specifically, the input layer of the large model writes the original data (topological data) that the user needs to operate into the vector database. The input layer will split the dynamic parameters input by the user. If there are sub-parameters, they will be processed by the small model to improve the accuracy of the large model operation, thereby completing the operation. That is, through the large model, the input abnormal fluctuation data and the results of the second safety hazard perception can be written into the vector database. The output layer of the large model is used to store the results after ChatGPT processing, from which users can read the final desired results.

[0036] Vector database: mainly responsible for marking and analyzing the calculation results of large models.

[0037] In one implementation, the importance evaluation algorithm includes a first matrix, a second matrix, a third matrix, an importance coefficient of the first matrix, an importance coefficient of the second matrix, and an importance coefficient of the third matrix.

[0038] Specifically, the importance evaluation algorithm: Let the first matrix Q matrix of the lth attention head be represented as Q l, the second matrix K matrix be represented as K l, and the third matrix V matrix be represented as Vl. Then the L2 norm of the Q matrix of the lth attention head is ||Q||l 2, the L2 norm of the K matrix is ​​represented as ||K||l2, and the L2 norm of the V matrix is ​​regarded as ||V||l2. The importance evaluation calculation formula is:

[0039] Among them, α1 is the importance coefficient of the Q matrix, α2 is the importance coefficient of the K matrix, and α3 is the importance coefficient of the V matrix.

[0040] In view of the current situation where there are fewer quality fluctuations, that is, the quality data with fewer features are calculated using the ChatGPT large language model combined with the importance evaluation algorithm to filter out the abnormal diagnostic feature data and only retain the truly abnormal fluctuation data.

[0041] It should be noted that the execution subject of the safety hazard perception method provided in the embodiment of the present application can be a safety hazard perception device, or a control module in the safety hazard perception device for executing the safety hazard perception method. In the embodiment of the present application, the safety hazard perception device provided in the embodiment of the present application is described by taking the execution of the safety hazard perception method by the safety hazard perception device as an example.

[0042] Figure 3 Schematic diagram of the structure of the potential safety hazard sensing device according to an embodiment of the present application. Figure 3 As shown, the safety hazard perception device 300 includes: a processing module 310 and a perception module 320.

[0043] The processing module 310 is used to score the user perception through the quality difference index to obtain the user perception score, wherein the quality difference index includes user perception and packet loss rate / stuttering rate; the perception module 320 is used to perform the first safety hazard perception through the quality difference prediction formula when the user perception score is greater than a preset threshold.

[0044] In one implementation, the processing module 310 is used to score based on the percentage of data in which the user-perceived time exceeds the preset time and the network delay does not exceed the preset time, and score based on the ratio of the packet loss rate / stuttering rate in a preset time period to the historical average packet loss rate / stuttering rate trend line in the preset time period.

[0045] In one implementation, the perception module 320 is also used to determine the core application service topology based on the association relationship of the log service application database, and the core application service topology includes the relationship between different servers, servers and databases, middleware, server core processors, memory, disks, and processes; obtain topology data based on the core application service topology from the log of each service, and the topology data includes operation monitoring data between different servers, servers and databases, middleware, server core processors, memory, disks, and processes; and perform comprehensive security risk perception based on the topology data and a preset large model.

[0046] In one implementation, the perception module 320 is used to perform a second safety hazard perception based on the topological data and a preset large model; and perform a comprehensive safety hazard perception based on the results of the first safety hazard perception and the results of the second safety hazard perception.

[0047] In one implementation, the perception module 320 is used to perform calculation filtering on the operation monitoring data through an importance assessment algorithm, filter out abnormal diagnostic monitoring data, and obtain abnormal fluctuation data in the monitoring data; and perform the second safety hazard perception through the abnormal fluctuation data and the large model.

[0048] In one implementation, the perception module 320 is further used to write the input abnormal fluctuation data and the result of the second safety hazard perception into a vector database through the large model.

[0049] In one implementation, the perception module 320, the importance evaluation algorithm includes a first matrix, a second matrix, a third matrix, an importance coefficient of the first matrix, an importance coefficient of the second matrix, and an importance coefficient of the third matrix.

[0050] The potential safety hazard sensing device in the embodiment of the present application may be a device, or a component, integrated circuit, or chip in a terminal. The device may be a mobile electronic device or a non-mobile electronic device. Exemplarily, the mobile electronic device may be a mobile phone, a tablet computer, a laptop computer, a PDA, an in-vehicle electronic device, a wearable device, an ultra-mobile personal computer (UMPC), a netbook, or a personal digital assistant (PDA), etc., and the non-mobile electronic device may be a server, a network attached storage (NAS), a personal computer (PC), a television (TV), a teller machine or a self-service machine, etc., which is not specifically limited in the embodiment of the present application.

[0051] The potential safety hazard sensing device in the embodiment of the present application may be a device having an operating system. The operating system may be an Android operating system, an iOS operating system, or other possible operating systems, which are not specifically limited in the embodiment of the present application.

[0052] The potential safety hazard sensing device provided in the embodiment of the present application can achieve Figure 1 To avoid repetition, the various processes implemented by the method embodiment are not described here.

[0053] like Figure 4 As shown, an embodiment of the present application further provides an electronic device 400, including a processor 401 and a memory 402, wherein the memory 402 stores a program or instruction that can be executed on the processor 401, and the program or instruction, when executed by the processor 401, achieves: scoring user perception through a quality difference indicator to obtain a user perception score, wherein the quality difference indicator includes user perception and packet loss rate / stuttering rate; when the user perception score is greater than a preset threshold, performing a first safety hazard perception through a quality difference prediction formula.

[0054] In one implementation, scoring is performed based on the percentage of data whose user-perceived time exceeds a preset time and whose network delay does not exceed the preset time in the alarm data; scoring is performed based on the ratio of the packet loss rate / stuttering rate in a preset time period to the historical average packet loss rate / stuttering rate trend line in the preset time period.

[0055] In one implementation, when the user perception score is greater than a preset threshold, after the security risk perception is performed through the quality difference prediction formula, the core application service topology is determined based on the association between the log service application database, and the core application service topology includes the relationship between different servers, servers and databases, middleware, server core processors, memory, disks, and processes; topology data based on the core application service topology is obtained from the log of each service, and the topology data includes operation monitoring data between different servers, servers and databases, middleware, server core processors, memory, disks, and processes; and comprehensive security risk perception is performed based on the topology data and a preset large model.

[0056] In one implementation, a second safety hazard perception is performed based on the topological data and a preset large model; and a comprehensive safety hazard perception is performed based on a result of the first safety hazard perception and a result of the second safety hazard perception.

[0057] In one implementation, the operation monitoring data is filtered by an importance assessment algorithm to filter out abnormal diagnostic monitoring data, thereby obtaining abnormal fluctuation data in the monitoring data; and the second safety hazard perception is performed through the abnormal fluctuation data and the large model.

[0058] In one implementation, after the second safety hazard perception is performed through the abnormal fluctuation data and the large model, the input abnormal fluctuation data and the result of the second safety hazard perception are written into a vector database through the large model.

[0059] In one implementation, the importance evaluation algorithm includes a first matrix, a second matrix, a third matrix, an importance coefficient of the first matrix, an importance coefficient of the second matrix, and an importance coefficient of the third matrix.

[0060] The specific execution steps can refer to the various steps of the above-mentioned safety hazard perception method implementation example, and can achieve the same technical effect. To avoid repetition, they will not be repeated here.

[0061] It should be noted that the electronic devices in the embodiments of the present application include: servers, terminals, or other devices except terminals.

[0062] The above electronic device structure does not constitute a limitation on the electronic device. The electronic device may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently. For example, the input unit may include a graphics processing unit (GPU) and a microphone, and the display unit may be configured with a display panel in the form of a liquid crystal display, an organic light-emitting diode, etc. The user input unit includes a touch panel and at least one of other input devices. The touch panel is also called a touch screen. Other input devices may include, but are not limited to, a physical keyboard, function keys (such as volume control keys, switch keys, etc.), a trackball, a mouse, and a joystick, which will not be repeated here.

[0063] The memory can be used to store software programs and various data. The memory may mainly include a first storage area for storing programs or instructions and a second storage area for storing data, wherein the first storage area may store an operating system, an application program or instructions required for at least one function (such as a sound playback function, an image playback function, etc.), etc. In addition, the memory may include a volatile memory or a non-volatile memory, or the memory may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. Volatile memory can be random access memory (RAM), static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct memory bus random access memory (DRRAM).

[0064] The processor may include one or more processing units; optionally, the processor integrates an application processor and a modem processor, wherein the application processor mainly processes operations related to the operating system, user interface, and application programs, and the modem processor mainly processes wireless communication signals, such as a baseband processor. It is understandable that the modem processor may not be integrated into the processor.

[0065] An embodiment of the present application also provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the various processes of the above-mentioned security hazard perception method embodiment are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0066] The processor is the processor in the electronic device described in the above embodiment. The readable storage medium includes a computer readable storage medium, such as ROM, RAM, magnetic disk or optical disk.

[0067] It should be noted that, in this article, the terms "comprise", "include" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise one..." do not exclude the presence of other identical elements in the process, method, article or device including the element. In addition, it should be pointed out that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in reverse order according to the functions involved, for example, the described method may be performed in an order different from that described, and various steps may also be added, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0068] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a computer software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present application.

[0069] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present application, ordinary technicians in this field can also make many forms without departing from the purpose of the present application and the scope of protection of the claims, all of which are within the protection of the present application.

Claims

1. A method for perceiving potential safety hazards, characterized in that: include: Scoring the user perception by using the quality difference index to obtain a user perception score, wherein the quality difference index includes user perception and packet loss rate / stuttering rate; When the user perception score is greater than a preset threshold, a first safety hazard perception is performed using a quality difference prediction formula.

2. The method according to claim 1, characterized in that The scoring of user perception by quality index includes: Scoring is performed based on the percentage of data in which the user-perceived time exceeds the preset time and the network delay does not exceed the preset time in the alarm data; The score is given according to the ratio of the packet loss rate / jamming rate in a preset time period to the historical average packet loss rate / jamming rate trend line in the preset time period.

3. The method according to claim 1, characterized in that When the user perception score is greater than a preset threshold, after the safety hazard perception is performed using the quality difference prediction formula, the method further includes: Determine the core application service topology based on the association relationship of the log service application database, wherein the core application service topology includes the relationship between different servers, servers and databases, middleware, server core processors, memory, disks, and processes; Obtaining topology data based on the core application service topology from the log of each service, the topology data including operation monitoring data between different servers, between servers and databases, middleware, server core processors, memory, disks, and processes; Comprehensive safety hazard perception is performed based on the topological data and the preset large model.

4. The method according to claim 3, characterized in that: The comprehensive safety hazard perception based on the topological data and the preset large model includes: Performing a second safety hazard perception based on the topological data and the large model; Comprehensive safety hazard perception is performed based on the results of the first safety hazard perception and the results of the second safety hazard perception.

5. The method according to claim 3, characterized in that: The performing the second safety hazard perception according to the topological data and the preset large model includes: The operation monitoring data is filtered by an importance evaluation algorithm to filter out abnormal diagnosis monitoring data, thereby obtaining abnormal fluctuation data in the monitoring data; The second safety hazard perception is performed through the abnormal fluctuation data and the large model.

6. The method according to claim 5, characterized in that After the second potential safety hazard perception is performed using the abnormal fluctuation data and the large model, the method further includes: The input abnormal fluctuation data and the result of the second safety hazard perception are written into the vector database through the large model.

7. The method according to claim 5, characterized in that The importance evaluation algorithm includes a first matrix, a second matrix, a third matrix, an importance coefficient of the first matrix, an importance coefficient of the second matrix, and an importance coefficient of the third matrix.

8. A safety hazard sensing device, characterized in that: include: A processing module, used to score the user perception by using a quality difference index to obtain a user perception score, wherein the quality difference index includes user perception and a packet loss rate / stuttering rate; The perception module is used to perceive the first safety hazard through a quality difference prediction formula when the user perception score is greater than a preset threshold.

9. An electronic device, characterized in that: It includes a processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein the program or instruction, when executed by the processor, implements the steps of the safety hazard perception method as described in any one of claims 1 to 7.

10. A readable storage medium, characterized in that: The readable storage medium stores programs or instructions, and when the programs or instructions are executed by the processor, the steps of the safety hazard perception method as described in any one of claims 1-7 are implemented.

Images