Computer supervision system based on edge calculation model

Abstract

The invention belongs to the technical field of computer supervision, and provides a computer supervision system based on an edge computing model, and the system comprises an edge device module which is used for collecting computer data information in real time through an edge device, carrying out the preprocessing, and carrying out the real-time recognition and response according to a preset rule; the intelligent identification module is used for identifying potential safety risks or abnormal behaviors; the early warning response module is used for generating an early warning signal and executing a response action; the central management module is used for collecting data and analysis results from the edge devices, summarizing the data and monitoring the running state of the whole system; the communication cooperation module is used for carrying out data transmission and instruction receiving between the edge devices and the cloud, and sharing and cooperating information between different edge devices; according to the invention, by realizing efficient data processing and rapid safety response, potential safety risks can be intelligently identified and processed, and the accuracy and stability of the system are improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of computer supervision, and specifically relates to a computer supervision system based on an edge computing model. Background Art

[0002] In today's information age, the supervision and security of computer systems face unprecedented challenges. Existing computer security monitoring systems generally rely on centralized cloud computing architectures, and the traditional data processing methods they use often have many shortcomings.

[0003] First, in the traditional monitoring system, the data center analyzes and processes data only after receiving it from various edge devices. This process not only causes delays in data transmission, but also wastes network bandwidth due to the large amount of data transmission. Especially in scenarios that require real-time response, any delay may result in security incidents not being processed immediately, resulting in potential losses. Existing technologies usually rely on predefined rules and patterns to detect security incidents. This approach often faces the following problems: First, for new security threats and attack methods, traditional protection measures lack flexibility and adaptability, making it difficult to quickly identify and respond; second, when facing complex security incidents, rule-based identification alone not only has low accuracy, but also easily generates a large number of false positives and missed positives, resulting in inefficiency of security operators in handling incidents. In addition, most traditional security systems adopt a centralized management method, which is prone to single point failure. When a data center or cloud service fails, the function of the entire security monitoring system is weakened, and may even cause the system to be completely paralyzed. This single architecture limits the availability and reliability of the system, especially at critical moments, it may not be able to provide users with the necessary security guarantees.

[0004] To this end, technicians in this field have proposed a computer supervision system based on an edge computing model, which aims to combine data processing, intelligent identification, early warning response and real-time monitoring to improve the overall performance of the system, reduce risks and ensure safety. Summary of the invention

[0005] In order to solve the above technical problems, the present invention provides a computer supervision system based on an edge computing model to solve the problems raised in the background technology.

[0006] A computer supervision system based on an edge computing model, comprising:

[0007] The edge device module is used to collect computer device status, network traffic and user behavior in real time through edge devices, pre-process the collected data, and instantly identify and respond according to preset rules;

[0008] Intelligent identification module, which is used to analyze the pre-processed data, identify potential security risks or abnormal behaviors, and identify new security risks by learning historical data and known threat patterns to obtain analysis results;

[0009] An early warning response module is used to generate an early warning signal when the intelligent recognition module identifies a security risk or abnormal behavior, and execute a response action according to a preset security policy;

[0010] The central management module is used to collect data and analysis results from various edge devices, summarize the data, and monitor the overall system operation status;

[0011] The communication collaboration module is used to transmit data and receive instructions between edge devices and the cloud, and to share and collaborate on information between different edge devices.

[0012] Preferably, the edge device in the edge device module includes built-in sensors and camera devices;

[0013] The preprocessing includes cleaning, compressing and formatting the collected data;

[0014] The edge device module instantly identifies and responds to simple security events according to preset rules. The preset rules are represented by a set. The blacklist is set B, which contains source IP addresses identified as malicious, represented as: B = {IP1, IP2, ..., IP n}, the network requests monitored by the edge device are represented as a set R, then the set R is expressed as: R = {(r1, t1), (r2, t2), ..., (r m ,t m )}, where r i Indicates the source IP address of the request, t i Indicates the timestamp of the request;

[0015] By defining the detection function D, we can determine whether the request is a malicious request, which is expressed as:

[0016]

[0017] Among them, D(r i )=1 means r i For a malicious request, the edge device responds immediately and performs the following response operations:

[0018]

[0019] When a request is identified as malicious, a blocking operation is performed; and for all blocked requests, the edge device records them in the log, represented as:

[0020] L = {(r i ,t i )|D(r i )=1}

[0021] Among them, L is the set of all logs, including the source IP addresses of all blocked requests and their corresponding timestamps.

[0022] Preferably, the intelligent identification module analyzes the preprocessed data by cooperating with the cloud. The anomaly detection is performed by establishing a baseline model M to count the normal network traffic, which is expressed as: M = {μ, σ}, where μ is the mean of the normal traffic and σ is the standard deviation. The conditions for anomaly detection are defined by setting a threshold:

[0023] |X-μ|>ασ

[0024] Where X is the detected traffic data, μ is the mean of the data set, that is, the average value of all data, |X-μ| represents the absolute distance between the data point X and the mean μ, which is used to measure the degree of deviation between X and the center of the data set, α represents the preset threshold parameter, which is used to determine the range of abnormal data, σ represents the standard deviation of the data set, which is used to measure the degree of dispersion of the data, ασ represents the threshold range based on the standard deviation, which is used to determine which data points are considered abnormal. When |X-μ|>ασ, the data point is considered abnormal;

[0025] Association analysis is performed through association rules, which is expressed as:

[0026] A→B(support(A∧B)≥min_support,confidence(A→B)≥min_confidence)

[0027] When there is a correlation between a user's abnormal login behavior A and potential intrusion behavior B, monitor this type of event;

[0028] The intelligent identification module identifies and classifies the monitored risks, which is expressed as:

[0029] R = {(X i ,T i ,C i )|i=1,2,...,N}

[0030] Among them, R is the set of all identified risks, X i Characteristics that indicate risk or unusual behavior, T i Indicates the monitored time, C i Indicates the risk category.

[0031] Preferably, the intelligent recognition module is also used to use the historical data set D trainTrain the model to identify normal and abnormal behaviors by setting the feature F train and label Y train :

[0032] D train ={(F i ,Y i )|i=1,...,N}

[0033] Use machine learning algorithms to train the model M ML ,get:

[0034] M ML =train(F train ,Y train )

[0035] For new data F new Make a prediction and get: in Represents the recognition result predicted by new data.

[0036] Preferably, the early warning response module generates an early warning signal according to the security risk or abnormal behavior detected by the intelligent identification module;

[0037] After the early warning signal is generated, the early warning response module executes the response measures according to the preset security policy. The policy set of the preset security policy is S, which is expressed as: S = {S1, S2, ..., S n}, which contains multiple response actions S j ;

[0038] Each response measure is selected based on the risk type and severity to determine the response strategy R s (C i ), execute the response action according to the response strategy, expressed as E(R s (C i ));

[0039] Perform real-time monitoring and regular auditing, and use timelines to represent the record collection of all events:

[0040] Logs = {(P i ,R s (P i ),T i )|i=1,2,...M}

[0041] Among them, P i Represents each warning signal, R s (P i ) represents the response measures taken to the warning, T i Indicates a timestamp.

[0042] Preferably, the central management module is used to collect data and analysis results from each edge device, visualize them in the form of charts and reports, and monitor the operating status of the entire system, including the health status of the edge devices and the stability of the network connection.

[0043] Preferably, the communication collaboration module uploads data to the cloud periodically or according to event triggering through the edge device, and the cloud platform sends instructions to the edge device to control its behavior or configuration. The instruction format is:

[0044] I i ={Cmd,Params,Target}

[0045] Among them, Cmd indicates the command type, Params indicates additional parameters, and Target indicates the target device identifier;

[0046] The edge device receives the command through the following mechanism: Receive(I i )→Process(I i );

[0047] Edge devices obtain each other's data through a local area network or a mesh network. All edge devices upload their data to the cloud, which aggregates and analyzes it.

[0048] Set the collaborative tasks between edge devices, and the edge devices will collaborate after receiving the collaborative instructions in the cloud.

[0049] Compared with the prior art, the present invention has the following beneficial effects:

[0050] 1. The present invention collects and preprocesses data in real time through the edge device module, instantly identifies and responds to simple security events according to preset rules, effectively filters potential security threats and reduces risks; and analyzes the preprocessed data through the intelligent recognition module to identify potential security risks or abnormal behaviors, and identifies new security risks by learning historical data and known threat patterns, thereby improving the intelligence and accuracy of the system.

[0051] 2. The present invention generates a warning signal through the warning response module according to the security risks or abnormal behaviors detected by the intelligent identification module, and executes the response action according to the preset security policy to ensure the immediate handling of potential security threats and abnormal behaviors; and the overall edge computing model can filter and process data locally, and only upload important and necessary information to the cloud. This method significantly reduces the network bandwidth occupancy and cost, and also reduces the burden on cloud services.

[0052] 3. Through real-time monitoring and regular auditing, the system of the present invention can immediately detect and handle potential security threats and abnormal behaviors, thereby improving the stability and security of the entire system. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 This is a block diagram of the computer supervision system based on the edge computing model of the present invention. DETAILED DESCRIPTION

[0054] The following embodiments of the present invention are described in further detail in conjunction with the accompanying drawings and examples. The following examples are used to illustrate the present invention, but are not intended to limit the scope of the present invention.

[0055] As attached Figure 1 As shown:

[0056] Embodiment: The present invention provides a computer monitoring system based on an edge computing model, comprising:

[0057] The edge device module is used to collect computer device status, network traffic and user behavior in real time through edge devices, pre-process the collected data, and instantly identify and respond according to preset rules;

[0058] Intelligent identification module, which is used to analyze the pre-processed data, identify potential security risks or abnormal behaviors, and identify new security risks by learning historical data and known threat patterns to obtain analysis results;

[0059] The early warning response module is used to generate an early warning signal when the intelligent recognition module identifies security risks or abnormal behaviors, and execute response actions according to the preset security policies;

[0060] The central management module is used to collect data and analysis results from various edge devices, summarize the data, and monitor the overall system operation status;

[0061] The communication collaboration module is used to transmit data and receive instructions between edge devices and the cloud, and to share and collaborate on information between different edge devices.

[0062] Specifically, the edge devices in the edge device module include built-in sensors and camera devices for detecting the status of computer devices and information such as network traffic and user behavior;

[0063] Preprocessing includes cleaning, compressing and formatting the collected data;

[0064] The edge device module instantly identifies and responds to simple security events according to preset rules. The preset rules are represented by a set. The blacklist is set B, which contains source IP addresses identified as malicious, represented as: B = {IP1, IP2, ..., IP n}, the network requests monitored by the edge device are represented as a set R, then the set R is expressed as: R = {(r1, t1), (r2, t2), ..., (r m ,t m )}, where r i Indicates the source IP address of the request, t i Indicates the timestamp of the request;

[0065] By defining the detection function D, we can determine whether the request is a malicious request, which is expressed as:

[0066]

[0067] Among them, D(r i )=1 means r i For a malicious request, the edge device responds immediately and performs the following response operations:

[0068]

[0069] When a request is identified as malicious, a blocking operation is performed; and for all blocked requests, the edge device records them in the log, represented as:

[0070] L = {(r i ,t i )D(r i )=1}

[0071] Among them, L is the set of all logs, including the source IP addresses of all blocked requests and their corresponding timestamps.

[0072] The above processing method can effectively filter potential security threats in a short period of time, reduce risks, and achieve efficient initial protection in the entire system architecture, and instantly identify and respond to malicious network requests according to preset rules.

[0073] The intelligent identification module analyzes the preprocessed data by collaborating with the cloud. Anomaly detection establishes a baseline model M to count normal network traffic, expressed as: M = {μ, σ}, where μ is the mean of normal traffic and σ is the standard deviation. The conditions for anomaly detection are defined by setting thresholds:

[0074] |X-μ|>ασ

[0075] Where X is the detected traffic data, μ is the mean of the data set, that is, the average value of all data, |X-μ| represents the absolute distance between the data point X and the mean μ, which is used to measure the degree of deviation between X and the center of the data set, α represents the preset threshold parameter, which is used to determine the range of abnormal data, σ represents the standard deviation of the data set, which is used to measure the degree of dispersion of the data, ασ represents the threshold range based on the standard deviation, which is used to determine which data points are considered abnormal. When |X-μ|>ασ, the data point is considered abnormal;

[0076] Association analysis is performed through association rules, which is expressed as:

[0077] A→B(support(A∧B)≥min_support,confidence(A→B)≥min_confidence)

[0078] Among them, A is the antecedent of the rule, B is the consequent of the rule, support(A∧B)≥min_support represents the condition about support, and support refers to the proportion of transactions (or records) containing both A and B in the total number of transactions; min_support is a preset threshold, and further analysis is performed only when the support of rule A→B is greater than or equal to the threshold; similarly, confidence(A→B)≥min_confidence represents the condition about confidence, and min_confidence is another preset threshold, and the rule is considered to be a valid association rule only when the confidence of rule A→B is greater than or equal to the threshold; when there is a correlation between the user's abnormal login behavior A and the potential intrusion behavior B, such events are monitored;

[0079] The intelligent identification module identifies and classifies the monitored risks, which are expressed as:

[0080] R = {(X i ,T i ,C i )|i=1,2,...,N}

[0081] Among them, R is the set of all identified risks, X i Characteristics that indicate risk or unusual behavior, T i Indicates the monitored time, C i Indicates the risk category.

[0082] The intelligent recognition module is also used to use the historical data set D train Train the model to identify normal and abnormal behaviors by setting the feature F train and label Y train :

[0083] D train={(F i ,Y i )|i=1,...,N}

[0084] Use machine learning algorithms to train the model M ML ,get:

[0085] M ML =train(F train ,Y train )

[0086] For new data F new Make a prediction and get: in Represents the recognition result predicted by new data.

[0087] The intelligent identification module can effectively conduct in-depth analysis, identify and warn of new security risks. It can detect abnormal activities in the network and discover potential threats by establishing a baseline model in anomaly detection. It can mine association rules in the data in association analysis to discover the relationship between different events, such as the association between login anomalies and potential intrusion behaviors. It can also train models to identify normal network behaviors and abnormal behaviors, and discover potential network security threats by monitoring new data. This makes security identification and response more comprehensive and intelligent.

[0088] The early warning response module generates early warning signals based on the security risks or abnormal behaviors detected by the intelligent identification module;

[0089] After the early warning signal is generated, the early warning response module executes the response measures according to the preset security policy. The policy set of the preset security policy is S, which is expressed as: S = {S1, S2, ..., S n}, which contains multiple response actions S j ;

[0090] Each response measure is selected based on the risk type and severity to determine the response strategy R s (C i ), execute the response action according to the response strategy, expressed as E(R s (C i ));

[0091] In order to ensure the effectiveness of the early warning response module, real-time monitoring and regular auditing are carried out, and a timeline is used to represent the record set of all events:

[0092] Logs = {(P i ,R s (P i ),T i )|i=1,2,...M}

[0093] Among them, Pi Represents each warning signal, R s (P i ) represents the response measures taken to the warning, T i Indicates a timestamp.

[0094] Through the above steps, the early warning response module can efficiently generate early warning signals and execute response actions, thereby ensuring that potential security threats and abnormal behaviors are handled immediately.

[0095] The central management module is used to collect data and analysis results from various edge devices, visualize them in the form of charts and reports, and monitor the operating status of the entire system, including the health of edge devices and the stability of network connections.

[0096] The communication collaboration module uploads data to the cloud periodically or based on event triggers through the edge device. The cloud platform sends instructions to the edge device to control its behavior or configuration. The instruction format is:

[0097] I i ={Cmd,Params,Target}

[0098] Among them, Cmd indicates the command type, Params indicates additional parameters, and Target indicates the target device identifier;

[0099] The edge device receives the command through the following mechanism: Receive(I i )→Process(I i );

[0100] Edge devices obtain each other's data through a local area network or a mesh network. All edge devices upload their data to the cloud, which aggregates and analyzes them. Collaboration tasks between edge devices are set, and edge devices collaborate after receiving collaboration instructions from the cloud. Calculation results are shared between devices for more intelligent decision-making. Devices can be adjusted through the result feedback mechanism.

[0101] The communication collaboration module ensures that the entire system works efficiently in a dynamic environment through real-time data transmission and command interaction between edge devices and the cloud, as well as information sharing and collaboration between devices. It also monitors device health and the stability of network connections to facilitate intelligent decision-making and immediate response to needs.

[0102] From the above, we can see that the computer supervision system based on the edge computing model is constructed from six aspects: data processing, intelligent decision-making, resource management, security and privacy, communication collaboration, and edge cloud integration. It is to optimize the data processing process, improve response speed and system efficiency, and reduce communication delays and bandwidth usage. These aspects are combined to form an efficient, flexible, and secure edge computing model that is suitable for data-intensive and real-time-intensive computer supervision systems.

[0103] Importantly, it should be noted that the construction and arrangement of the present application shown in a plurality of different exemplary embodiments are only exemplary. Although only a few embodiments are described in detail in this disclosure, it should be readily understood by those who refer to this disclosure that many modifications are possible without substantially departing from the novel teachings and advantages of the subject matter described in the application. Without departing from the scope of the present invention, other replacements, modifications, changes and omissions may be made in the design, operating conditions and arrangement of the exemplary embodiments. Therefore, the present invention is not limited to a specific embodiment, but extends to a variety of modifications still falling within the scope of the appended claims.

[0104] Additionally, in order to provide a concise description of exemplary embodiments, all features of an actual embodiment (ie, those features that are not relevant to the best mode presently contemplated for carrying out the invention or those that are not relevant to implementing the invention) may not be described.

[0105] It should be understood that in the development of any actual implementation, as in any engineering or design project, numerous implementation-specific decisions may be made. Such a development effort may be complex and time-consuming, but for those of ordinary skill having the benefit of this disclosure, without undue experimentation, the development effort will be a routine task of design, fabrication, and production.

[0106] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A computer supervision system based on an edge computing model, characterized in that: include: The edge device module is used to collect computer device status, network traffic and user behavior in real time through edge devices, pre-process the collected data, and instantly identify and respond according to preset rules; Intelligent identification module, which is used to analyze the pre-processed data, identify potential security risks or abnormal behaviors, and identify new security risks by learning historical data and known threat patterns to obtain analysis results; An early warning response module is used to generate an early warning signal when the intelligent recognition module identifies a security risk or abnormal behavior, and execute a response action according to a preset security policy; The central management module is used to collect data and analysis results from various edge devices, summarize the data, and monitor the overall system operation status; The communication collaboration module is used to transmit data and receive instructions between edge devices and the cloud, and to share and collaborate on information between different edge devices.

2. A computer monitoring system based on an edge computing model as claimed in claim 1, characterized in that: The edge devices in the edge device module include built-in sensors and camera devices; The preprocessing includes cleaning, compressing and formatting the collected data; The edge device module instantly identifies and responds to simple security events according to preset rules. The preset rules are represented by a set. The blacklist is set B, which contains source IP addresses identified as malicious, represented as: B = {IP1, IP2, ..., IP n }, the network requests monitored by the edge device are represented as a set R, then the set R is expressed as: R = {(r1, t1), (r2, t2), ..., (r m ,t m )}, where r i Indicates the source IP address of the request, t i Indicates the timestamp of the request; By defining the detection function D, we can determine whether the request is a malicious request, which is expressed as: Among them, D(r i )=1 means r i For a malicious request, the edge device responds immediately and performs the following response operations: When a request is identified as malicious, a blocking operation is performed; and for all blocked requests, the edge device records them in the log, represented as: L={(r i ,t i )|D(r i )=1} Among them, L is the set of all logs, including the source IP addresses of all blocked requests and their corresponding timestamps.

3. A computer monitoring system based on an edge computing model as claimed in claim 1, characterized in that: The intelligent recognition module analyzes the preprocessed data by cooperating with the cloud. The anomaly detection is performed by establishing a baseline model M to count the normal network traffic, which is expressed as: M = {μ, σ}, where μ is the mean of the normal traffic and σ is the standard deviation. The conditions for anomaly detection are defined by setting a threshold: |X-μ|>ασ Where X is the detected traffic data, μ is the mean of the data set, that is, the average value of all data, |X-μ| represents the absolute distance between the data point X and the mean μ, which is used to measure the degree of deviation between X and the center of the data set, α represents the preset threshold parameter, which is used to determine the range of abnormal data, σ represents the standard deviation of the data set, which is used to measure the degree of dispersion of the data, ασ represents the threshold range based on the standard deviation, which is used to determine which data points are considered abnormal. When |X-μ|>ασ, the data point is considered abnormal; Association analysis is performed through association rules, which is expressed as: A→B(support(A∧B)≥min—support,confidence(A→B)≥min—confidence) When there is a correlation between a user's abnormal login behavior A and potential intrusion behavior B, monitor this type of event; The intelligent identification module identifies and classifies the monitored risks, which is expressed as: R={(X i ,T i ,C i )i=1,2,...,N} Among them, R is the set of all identified risks, X i Characteristics that indicate risk or unusual behavior, T i Indicates the monitored time, C i Indicates the risk category.

4. A computer monitoring system based on an edge computing model as claimed in claim 3, characterized in that: The intelligent recognition module is also used to use the historical data set D train Train the model to identify normal and abnormal behaviors by setting the feature F train and label Y train : D train ={(F i ,Y i )i=1,...,N} Use machine learning algorithms to train the model M ML ,get: M ML =train(F train ,Y train ) For new data F new Make a prediction and get: in Represents the recognition result predicted by new data.

5. A computer monitoring system based on an edge computing model as claimed in claim 1, characterized in that: The early warning response module generates an early warning signal according to the security risks or abnormal behaviors detected by the intelligent identification module; After the early warning signal is generated, the early warning response module executes the response measures according to the preset security policy. The policy set of the preset security policy is S, which is expressed as: S = {S1, S2, ..., S n }, which contains multiple response actions S j ; Each response measure is selected based on the risk type and severity to determine the response strategy R s (C i ), execute the response action according to the response strategy, expressed as E(R s (C i )); Perform real-time monitoring and regular auditing, and use timelines to represent the record collection of all events: Logs={(P i ,R s (P i ),T i )|i=1,2,...M} Among them, P i Represents each warning signal, R s (P i ) represents the response measures taken to the warning, T i Indicates a timestamp.

6. A computer monitoring system based on an edge computing model as claimed in claim 1, characterized in that: The central management module is used to collect data and analysis results from each edge device, visualize them in the form of charts and reports, and monitor the operating status of the entire system, including the health status of edge devices and the stability of network connections.

7. A computer monitoring system based on an edge computing model as claimed in claim 1, characterized in that: The communication collaboration module uploads data to the cloud periodically or according to event triggers through the edge device. The cloud platform sends instructions to the edge device to control its behavior or configuration. The instruction format is: I i ={Cmd,Params,Target} Among them, Cmd indicates the command type, Params indicates additional parameters, and Target indicates the target device identifier; The edge device receives the command through the following mechanism: Receive(I i )→Process(I i ); Edge devices obtain each other's data through a local area network or a mesh network. All edge devices upload their data to the cloud, which aggregates and analyzes it. Set the collaborative tasks between edge devices, and the edge devices will collaborate after receiving the collaborative instructions in the cloud.

Images