Abnormal user identification method, system and device and electronic equipment

Abstract

The invention provides an abnormal user identification method, system and device and electronic equipment, and relates to the technical field of data processing. The method comprises the following steps: acquiring multiple normal operations and multiple abnormal operations of a target user within a first preset time period, and equipment hardware information of a target host within the first preset time period; according to the equipment hardware information of the target host within each second preset time period, calculating an abnormal coefficient of the target host within the corresponding second preset time period; determining a normal operation corresponding to a second preset time period of which the abnormal coefficient is greater than a preset coefficient as an error marking operation; and determining whether the target user is an abnormal user or not according to the times of the multiple abnormal operations and the times of the multiple error marking operations. According to the method, the problem that the abnormal user and the abnormal operation thereof cannot be timely and accurately judged is solved.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to an abnormal user identification method, system, device and electronic device. Background Art

[0002] With the development of Internet technology, the network information security of computer clusters has become an indispensable key link. In order to effectively make up for the limitations of traditional security technology defense, log analysis systems have come into being. Log analysis systems aim to accurately identify abnormal operations through deep mining and correlation analysis of logs. Specifically, when a user attempts to operate resource information outside of his or her authority, the operation is judged as an abnormal operation; conversely, if the user's operation complies with his or her authority settings, it is considered a normal operation.

[0003] The log analysis system based on the big data platform not only strengthens the all-round support for computer cluster components, but also promotes the optimization and expansion of related security functions. However, in actual applications, due to the different log formats of various components, some log information is missing or not recorded independently, resulting in a large amount of key log data cannot be effectively collected and analyzed, affecting the accurate identification of abnormal users and their abnormal operations. Summary of the invention

[0004] The present application provides an abnormal user identification method, system, device and electronic device to solve the problem of being unable to timely and accurately identify abnormal users and their abnormal operations.

[0005] In a first aspect, the present application provides a method for identifying abnormal users, the method comprising:

[0006] Acquire multiple normal operations and multiple abnormal operations of the target user within a first preset time period, and device hardware information of the target host within the first preset time period; wherein the target host is a host operated by the target user in the computer cluster;

[0007] Calculate the abnormal coefficient of the target host in the corresponding second preset time period according to the device hardware information of the target host within each second preset time period; wherein each second preset time period refers to a time period in which the target user performs a normal operation;

[0008] Determine the normal operation corresponding to the second preset period in which the abnormal coefficient is greater than the preset coefficient as an error-marked operation; wherein each error-marked operation refers to an operation that is marked as a normal operation but is actually an abnormal operation;

[0009] Determine whether the target user is an abnormal user based on the number of multiple abnormal operations and the number of multiple error-marked operations.

[0010] In a possible design, the third preset time period is any one of a plurality of second preset time periods;

[0011] For the second preset time period, according to the device hardware information of the target host within each second preset time period, calculating the abnormal coefficient of the target host in the corresponding second preset time period includes:

[0012] Calculate the average value of the hardware usage increase rate and the temperature fluctuation coefficient of the target host in the third preset period of time according to the device hardware information of the target host within the third preset period of time;

[0013] According to the average value of the hardware usage increase rate of the target host in the third preset time period and the temperature fluctuation coefficient, the abnormal coefficient of the target host in the third preset time period is calculated.

[0014] In a possible design, according to the device hardware information of the target host within the third preset time period, calculating the average value of the hardware usage increase rate and the temperature fluctuation coefficient of the target host in the third preset time period includes:

[0015] According to the device hardware information of the target host within the third preset time period, the hardware usage rate hdt of the i-th hardware of the target host at time t1 is obtained. 1i , at time t2, the respective hardware utilization rate hdt 2i , and a temperature change Tt of the processor of the target host within a third preset period; wherein time t1 is the time when the third preset period starts, and time t2 is the time when the third preset period ends;

[0016] According to hdt 1i 、hdt 2i and Tt, calculate the hardware usage increase rate average PJ and temperature fluctuation coefficient TFC of the target host in the third preset time period.

[0017] In one possible design, according to hdt 1i 、hdt 2i and Tt, calculating the hardware usage increase rate mean PJ and temperature fluctuation coefficient TFC of the target host in the third preset time period, including:

[0018] Using the mean rise rate formula through hardware, according to hdt 1i and hdt 2i , calculate PJ; the formula for the average rise rate of hardware usage is:

[0019]

[0020] Calculate TFC based on Tt using the temperature floating coefficient formula; the temperature floating coefficient formula is:

[0021]

[0022] Among them, [t x , t y ] is the voltage warning period in the third preset period; [t m , t n ] is the fan speed warning period in the third preset period.

[0023] In a possible design, calculating the abnormal coefficient of the target host in the third preset period according to the average value of the hardware usage increase rate and the temperature fluctuation coefficient of the target host in the third preset period includes:

[0024] By using the abnormal coefficient formula, according to PJ and TFC, the abnormal coefficient YC of the target host in the third preset time period is calculated; the abnormal coefficient formula is:

[0025]

[0026] Wherein, a and b are both preset proportional coefficients.

[0027] In a possible design, whether the target user is an abnormal user is determined based on the number of multiple abnormal operations and the number of multiple wrongly marked operations, including:

[0028] According to the number of multiple abnormal operations ts, the number of multiple error marking operations tz, and the total number of operations tn, the actual abnormal operation ratio tr is determined; wherein the formula of tr is:

[0029]

[0030] When the actual ratio of abnormal operations is greater than the preset ratio, the target user is determined as an abnormal user.

[0031] In a possible design, obtaining multiple normal operations and multiple abnormal operations of the target user within the first preset time period includes:

[0032] Obtaining a resource information table and an operation information table of a target user within a first preset time period; wherein the resource information table includes the access rights of the target user, and the operation information table includes multiple operations of the target user;

[0033] The resource information table and the operation information table are compared and matched, and the operations that are successfully matched are marked as normal operations, and the operations that fail to match are marked as abnormal operations.

[0034] In a second aspect, the present application provides an abnormal user identification system, comprising:

[0035] A computer cluster, wherein the computer cluster includes a plurality of hosts;

[0036] Abnormal user identification device; wherein the abnormal user identification device is connected to multiple hosts for communication at the same time; the abnormal user identification device is used to execute an abnormal user identification method of the first aspect of the invention.

[0037] In a third aspect, the present application provides an abnormal user identification device, comprising:

[0038] An operation acquisition module is used to acquire multiple normal operations and multiple abnormal operations of a target user within a first preset period of time, and device hardware information of a target host within the first preset period of time; wherein the target host is a host operated by the target user in a computer cluster;

[0039] A coefficient calculation module, used to calculate the abnormal coefficient of the target host in the corresponding second preset time period according to the device hardware information of the target host within each second preset time period; wherein each second preset time period refers to a time period in which the target user performs a normal operation;

[0040] a marking operation module, used to determine the normal operation corresponding to the second preset period in which the abnormal coefficient is greater than the preset coefficient as an error marking operation; wherein each error marking operation refers to an operation that is marked as a normal operation but is actually an abnormal operation;

[0041] The user determination module is used to determine whether the target user is an abnormal user according to the number of multiple abnormal operations and the number of multiple error marking operations.

[0042] In a fourth aspect, the present application provides an electronic device, comprising: a processor, and a memory communicatively connected to the processor;

[0043] Memory stores computer-executable instructions;

[0044] The processor executes the computer execution instructions stored in the memory to implement an abnormal user identification method according to the first aspect of the invention.

[0045] In a fifth aspect, the present application provides a computer-readable storage medium, in which computer execution instructions are stored. When the computer execution instructions are executed by a processor, they are used to implement an abnormal user identification method according to the invention content of the first aspect.

[0046] In a sixth aspect, the present application provides a computer program product, including: a computer program, which, when executed by a processor, is used to implement an abnormal user identification method according to the invention content of the first aspect.

[0047] The present application provides an abnormal user identification method, system, device and electronic device, which obtain multiple normal operations and multiple abnormal operations of a target user within a first preset time period, and device hardware information of a target host within the first preset time period; wherein the target host is a host operated by the target user in a computer cluster; based on the device hardware information of the target host within each second preset time period, the abnormal coefficient of the target host in the corresponding second preset time period is calculated; wherein each second preset time period refers to a time period in which the target user performs a normal operation; the normal operation corresponding to the second preset time period with an abnormal coefficient greater than the preset coefficient is determined as an error-marked operation; wherein each error-marked operation refers to an operation that is marked as a normal operation but is actually an abnormal operation; and whether the target user is an abnormal user is determined based on the number of multiple abnormal operations and the number of multiple error-marked operations. The following technical effects are achieved: by monitoring the user's operating behavior, normal operation and abnormal operation, potential security threats can be discovered in time, which helps to protect the rights and interests of legitimate users; by calculating the device hardware information and operating behavior within a certain period of time, the abnormal coefficient and abnormal operation are determined, and the user's operating behavior records are associated with the problem nodes of the corresponding cluster. Taking into account the possible harm, the root cause of the problem is comprehensively considered to quickly locate the fault; the device information is combined with the user's operating behavior records to secondary judge whether the user's operation causes harm to the underlying host, as well as the penetration and privilege escalation operations of the attack type, adding important security guarantees to the big data management system and improving the operation optimization capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0049] Figure 1 A framework diagram of an application scenario of the abnormal user identification method provided in an embodiment of the present application;

[0050] Figure 2 Schematic diagram of the abnormal user identification method provided in the embodiment of the present application Figure 1 ;

[0051] Figure 3 Schematic diagram of the abnormal user identification method provided in the embodiment of the present application Figure 2 ;

[0052] Figure 4 A schematic diagram of the structure of an abnormal user identification device provided in an embodiment of the present application;

[0053] Figure 5 A schematic diagram of the structure of the electronic device hardware provided in an embodiment of the present application.

[0054] Reference numerals:

[0055] 100-abnormal user identification system; 110-target host; 120-computer cluster; 130-abnormal user identification device; 200-user;

[0056] 410 - acquisition operation module; 420 - coefficient calculation module; 430 - marking operation module; 440 - user determination module;

[0057] 510 - processor; 520 - memory; 530 - communication component; 540 - bus. DETAILED DESCRIPTION

[0058] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0059] In the embodiments of the present application, words such as "first" and "second" are used to distinguish the same or similar items with basically the same functions and effects. Those skilled in the art will understand that words such as "first" and "second" do not limit the quantity and execution order, and words such as "first" and "second" do not necessarily limit the difference. It should be noted that in the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "exemplary" or "for example" in the present application should not be interpreted as being more preferred or more advantageous than other embodiments or design schemes. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way. In the embodiments of the present application, "at least one" refers to one or more, and "more" refers to two or more.

[0060] It should be noted that the "at..." in the embodiment of the present application can be the instant when a certain situation occurs, or can be a period of time after a certain situation occurs, and the embodiment of the present application does not specifically limit this. In addition, the abnormal user identification method provided in the embodiment of the present application is only an example, and the abnormal user identification method can also include more or less content.

[0061] In order to clearly describe the technical solutions of the embodiments of the present application, some terms and technologies involved in the embodiments of the present application are briefly introduced below:

[0062] Computer cluster: A computer cluster is a system consisting of multiple independent computers connected by a network. These nodes work together to complete specific tasks. Clusters can be configured to provide higher computing performance, better fault tolerance, or a combination of both.

[0063] Big data platform: A big data platform refers to a collection of technical architectures and services designed to process large-scale data sets. It usually includes tools and technologies for storing, managing, and analyzing large amounts of data. A big data platform is capable of processing structured and unstructured data and supports both real-time and batch processing. In this application, the abnormal user identification system can be understood as a big data platform.

[0064] Component: A component is a relatively independent, reusable software or system building block that has clear functions and can interact with other components through interfaces. In enterprise application integration, components are middleware products used to connect different business systems and services. Such products help to achieve cross-platform data exchange and service calls, promote information sharing and business process automation.

[0065] Log analysis system: A log analysis system is a tool or platform for collecting, processing, storing, and analyzing log data from various sources. These logs can come from applications, operating systems, network devices, security systems, etc. Almost any information technology resource that generates event records can become an input source for a log analysis system. Through log analysis, organizations can monitor the status of their computer environment, detect abnormal behavior, respond to security threats, and ensure compliance.

[0066] With the rapid development of Internet technology, the amount of data is indeed growing exponentially. Big data also covers the characteristics of data diversity and high-speed generation, which has a profound impact on modern society, economy and technology.

[0067] In the era of big data and the Internet, network security has been mentioned many times. The development and utilization of data elements cannot be separated from network security. Network information security in the big data environment is even more important. In order to effectively make up for the limitations of traditional security technology defense, log analysis systems came into being. Log analysis systems not only strengthen the all-round support for computer cluster components, but also promote the optimization and expansion of related security functions.

[0068] In the prior art, the log analysis system based on the big data platform uses the mutual cooperation between different components to realize the security audit control between components. However, this method is not based on the security audit control of the big data platform, but on the components. It has not formed a systematic control solution based on the big data platform.

[0069] However, due to the non-uniform log formats of various components, missing log information of some components, and the fact that components are not recorded independently, a large amount of log data has not been observed, which may lead to problems in identifying abnormal users; and the log analysis system is not associated with the problem nodes of the big data platform, and lacks platform-level problem analysis and processing, which may result in abnormal operations not being monitored and the problem of incomplete analysis.

[0070] Based on this, how to timely and accurately identify abnormal users and their abnormal operations is a problem that needs to be solved urgently in this application.

[0071] Therefore, in order to accurately identify abnormal users and abnormal operations and solve the above-mentioned problems existing in the prior art, an embodiment of the present application provides an abnormal user identification method, which can accurately identify abnormal users and their abnormal operations based on a big data platform, log data and device hardware information.

[0072] Based on this, the embodiments of the present application provide an abnormal user identification method, system, device and electronic device, which can be used in the field of data processing technology, aiming to solve the problem that the log analysis system in the prior art needs to be based on the cooperation of multiple components and cannot accurately identify abnormal users and their abnormal operations.

[0073] Figure 1 The application scenario framework diagram of the abnormal user identification method provided in the embodiment of the present application can be used in the various application scenarios described below, and can also be used in other application scenarios not specified.

[0074] like Figure 1 As shown, the abnormal user identification system 100 can be used as a big data platform to identify abnormal users and their abnormal operations. The abnormal user identification system 100 includes a target host 110, a computer cluster 120 and an abnormal user identification device 130.

[0075] The abnormal user identification system 100 may store a resource information table and an operation information table of the user 200 .

[0076] When the user 200 operates the target host 110 , the device hardware information of the target host 110 can be acquired by the abnormal user identification system 100 , and subsequent steps can be executed according to the device hardware information.

[0077] When the user 200 logs in to the abnormal user identification system 100 , the operation behavior of the user will be recorded in the abnormal user identification system 100 , and the abnormal user identification system 100 will perform comparison and matching based on the operation behavior of the user to obtain a matching result.

[0078] The abnormal user identification system 100 will perform a marking operation step according to the matching result, and determine whether the user 200 is an abnormal user according to the number of abnormal operations.

[0079] Figure 2 Schematic diagram of the abnormal user identification method provided in the embodiment of the present application Figure 1 .like Figure 2 As shown, the method includes:

[0080] S201. Acquire multiple normal operations and multiple abnormal operations of a target user within a first preset time period, and device hardware information of a target host within the first preset time period.

[0081] The target host is the host operated by the target user in the computer cluster.

[0082] Specifically, the first preset time period is the sum of the time during which the target user performs normal operations and abnormal operations within a certain period of time, and may include multiple second preset time periods and time periods corresponding to abnormal operations.

[0083] According to the input records of the target user, the resource information of the data assets managed in the system includes: data asset name, description, location, format, data source, data quality status, business purpose, responsible person, and data protection requirements. The data protection requirements classify the data into different categories (such as public, internal use, confidential, etc.) according to the business value, sensitivity, regulatory compliance requirements and other factors of the data, and mark different security categories (such as public, internal use, confidential, etc.) for the resources in the resource information table to obtain the resource information table of the target user. Among them, the resource information table can also include the target user's permission, including access rights and modification rights.

[0084] An operation information table is generated based on the target user's operation behavior records automatically recorded by the system. The operation information includes: user unique identifier (Identification, referred to as ID), user name, operation timestamp, Internet Protocol Address (IP) address when the user operates, specific operations performed by the user (such as logging in, changing passwords, uploading files, and a series of commands executed, etc.), the name of the resource accessed or operated (such as file path, host IP and database table, etc.), operation result status (success, failure, etc.), and other related information, such as error code, session ID, etc.

[0085] According to the permission of the target user resource information table, operations that do not comply with the permission of the target user are determined as matching failures and marked as abnormal operations; operations that comply with the permission of the target user are determined as matching successes and marked as normal operations.

[0086] Obtain device hardware information of the target host within a first preset time period.

[0087] S202: Calculate the abnormality coefficient of the target host in the corresponding second preset time period according to the device hardware information of the target host in each second preset time period.

[0088] Each second preset time period refers to a time period during which the target user performs a normal operation.

[0089] Specifically, when the matching is successful, that is, marked as a normal operation, the abnormal coefficient calculation step is performed.

[0090] The hardware usage increase rate is calculated based on the device hardware information of the target host in each second preset time period, and the average value of the hardware usage increase rate in the corresponding second preset time period is calculated.

[0091] A temperature floating coefficient corresponding to the target host is calculated according to the device hardware information of the target host in each second preset time period.

[0092] The average value of the hardware usage rising rate and the temperature fluctuation coefficient are comprehensively calculated to obtain the abnormal coefficient of the target host in the corresponding second preset time period.

[0093] S203: Determine the normal operation corresponding to the second preset period in which the abnormal coefficient is greater than the preset coefficient as an error marking operation.

[0094] Each error-marked operation refers to an operation that is marked as a normal operation but is actually an abnormal operation.

[0095] Specifically, a preset coefficient corresponding to the normal usage of the target host is obtained, and the preset coefficient is compared with the abnormal coefficient to obtain a comparison result.

[0096] When the abnormal coefficient is greater than the preset coefficient, it is determined as an error marking operation; when the abnormal coefficient is not greater than the preset coefficient, it is determined as a normal operation.

[0097] S204: Determine whether the target user is an abnormal user according to the number of multiple abnormal operations and the number of multiple error marking operations.

[0098] Specifically, the total number of abnormalities is calculated based on the number of abnormal operations obtained above and the number of operations determined as error markings above; the total number of abnormalities is ratioed to the sum of the number of normal operations and abnormal operations of the user to obtain the ratio of abnormal operation records.

[0099] The ratio of the number of abnormal operation records is compared with the preset ratio. When the former is greater than the latter, the target user is determined to be an abnormal user; when the former is not greater than the latter, the target user is determined to be a normal user.

[0100] The present application provides an abnormal user identification method, which obtains multiple normal operations and multiple abnormal operations of a target user within a first preset time period, and device hardware information of a target host within the first preset time period; wherein the target host is a host operated by the target user in a computer cluster; based on the device hardware information of the target host within each second preset time period, the abnormality coefficient of the target host in the corresponding second preset time period is calculated; wherein each second preset time period refers to a time period in which the target user performs a normal operation; a normal operation corresponding to the second preset time period with an abnormality coefficient greater than the preset coefficient is determined as an error-marked operation; wherein each error-marked operation refers to an operation that is marked as a normal operation but is actually an abnormal operation; and whether the target user is an abnormal user is determined based on the number of multiple abnormal operations and the number of multiple error-marked operations. The following technical effects are achieved: by monitoring the user's operating behavior, normal operation and abnormal operation, potential security threats can be discovered in time, which helps to protect the rights and interests of legitimate users; by calculating the device hardware information and operating behavior within a certain period of time, the abnormal coefficient and abnormal operation are determined, and the user's operating behavior records are associated with the problem nodes of the corresponding cluster. Taking into account the possible harm, the root cause of the problem is comprehensively considered to quickly locate the fault; the device information is combined with the user's operating behavior records to secondary judge whether the user's operation causes harm to the underlying host, as well as the penetration and privilege escalation operations of the attack type, adding important security guarantees to the big data management system and improving the operation optimization capabilities.

[0101] Figure 3 Schematic diagram of the abnormal user identification method provided in the embodiment of the present application Figure 2 In this embodiment Figure 2 Based on the embodiment, the specific steps of an abnormal user identification method are described in detail. Figure 3 As shown, this embodiment provides an abnormal user identification method, including:

[0102] S301: Obtain a resource information table and an operation information table of a target user within a first preset time period.

[0103] The resource information table includes the access rights of the target user, and the operation information table includes multiple operations of the target user.

[0104] Specifically, multiple normal operations and multiple abnormal operations of the target user within a first preset time period, and device hardware information of the target host within the first preset time period are obtained; wherein the target host is a host operated by the target user in a computer cluster.

[0105] A resource information table of the target user within a first preset time period and an operation information table of the target user automatically recorded on the system within the first preset time period are obtained.

[0106] S302: Compare and match the resource information table and the operation information table.

[0107] Specifically, according to the permission indicated in the resource information table of the target user, the operation information table of the target user is matched to obtain a matching result of the target user.

[0108] When the matching result is a match failure, step S303 is executed. When the matching result is a match success, step S404 is executed.

[0109] S303: Mark the operation that fails to match as an abnormal operation.

[0110] Specifically, user behaviors performed by the target user outside of their authority are determined to be abnormal operations.

[0111] S304: Mark the successfully matched operation as a normal operation.

[0112] Specifically, user behaviors performed by the target user within the scope of their authority are determined to be normal operations.

[0113] S305, according to the device hardware information of the target host within the third preset time period, obtain the hardware usage rate hdt of the i-th hardware of the n hardware of the target host at time t1 1i , at time t2, the respective hardware utilization rate hdt 2i , and a temperature change Tt of the processor of the target host within a third preset time period.

[0114] The time t1 is the time when the third preset time period starts, and the time t2 is the time when the third preset time period ends. The third preset time period is any one of the plurality of second preset time periods.

[0115] Specifically, based on the device hardware information of the target host within each second preset time period, the abnormality coefficient of the target host in the corresponding second preset time period is calculated; wherein each second preset time period refers to a time period in which the target user performs a normal operation; based on the device hardware information of the target host within the third preset time period, the average hardware usage increase rate and the temperature fluctuation coefficient of the target host in the third preset time period are calculated.

[0116] The device hardware information includes information related to the central processing unit, information related to the random access memory, and information related to the graphics processing unit.

[0117] According to the device hardware information of the target host at the initial time t1 of the third preset period and the end time t2 of the third preset period, the hardware usage rate hdt of the i-th hardware at time t1 among the n hardware is calculated. 1i , at time t2, the respective hardware utilization rate hdt 2i , and a temperature change Tt of the processor of the target host within a third preset time period, and a temperature change Tt of the processor of the target host within a third preset time period.

[0118] S306, using the rising rate average formula through hardware, according to hdt 1i and hdt 2i , calculate PJ.

[0119] The formula for the average rate of increase of hardware usage is:

[0120]

[0121] Specifically, according to hdt 1i 、hdt 2i and Tt, calculate the hardware usage increase rate average PJ and temperature fluctuation coefficient TFC of the target host in the third preset time period.

[0122] According to the hardware use the rise rate average formula, hdt 1i and hdt 2i , calculate and obtain the average increase rate of hardware usage corresponding to the target host.

[0123] S307. Calculate TFC according to Tt using the temperature fluctuation coefficient formula.

[0124] The temperature fluctuation coefficient formula is:

[0125]

[0126] Among them, [t x , t y ] is the voltage warning period in the third preset period; [t m , t n] is the fan speed warning period in the third preset period.

[0127] Specifically, according to Tt and the temperature fluctuation coefficient formula, the temperature fluctuation coefficient corresponding to the target host in the third preset time period is calculated.

[0128] S308. Calculate the abnormality coefficient YC of the target host in the third preset time period according to the abnormality coefficient formula, PJ and TFC.

[0129] The formula for the anomaly coefficient is:

[0130]

[0131] Wherein, a and b are both preset proportional coefficients.

[0132] Specifically, the abnormal coefficient of the target host in the third preset period is calculated according to the average value of the hardware usage increase rate and the temperature fluctuation coefficient of the target host in the third preset period. According to the above-calculated PJ, TFC, and the abnormal coefficient formula, the corresponding abnormal coefficient of the target host in the third preset period is calculated.

[0133] S309: Determine the normal operation corresponding to the second preset period in which the abnormal coefficient is greater than the preset coefficient as an error marking operation.

[0134] Each error-marked operation refers to an operation that is marked as a normal operation but is actually an abnormal operation.

[0135] Specifically, the preset coefficient refers to the normal coefficient of the corresponding target host when the target user operates normally during the second preset time period.

[0136] When the abnormal coefficient is greater than the preset coefficient, the normal operation corresponding to the corresponding second preset time period is marked as an error-marked operation; that is, the aforementioned operation behavior is determined as a normal operation, but the normal operation is harmful to the system or data, and it should also be determined as an error-marked operation.

[0137] S310 , determining an actual abnormal operation ratio tr according to the number of multiple abnormal operations ts, the number of multiple error marking operations tz, and the total number of operations tn.

[0138] The formula of tr is:

[0139]

[0140] When the actual ratio of abnormal operations is greater than the preset ratio, the target user is determined as an abnormal user.

[0141] Specifically, whether the target user is an abnormal user is determined based on the number of abnormal operations and the number of wrongly marked operations. The actual abnormal operation ratio tr is determined based on the number of abnormal operations ts, the number of wrongly marked operations tz, and the total number of operations tn marked in step S303.

[0142] When the actual abnormal operation ratio tr is not greater than the preset ratio, it is determined that the target user is not an abnormal user.

[0143] When the actual abnormal operation ratio tr is greater than the preset ratio, the target user is determined to be an abnormal user.

[0144] The technical effect of the abnormal user identification method provided by the present application is that, through further monitoring of normal operations, normal and abnormal users can be accurately distinguished, which means that computing resources and service support can be allocated more effectively, and additional security measures can be provided. By identifying abnormal users, it is beneficial to protect the rights and interests of users.

[0145] like Figure 1 As shown, the present application also provides an abnormal user identification system, including:

[0146] A computer cluster, wherein the computer cluster includes a plurality of hosts;

[0147] Abnormal user identification device; wherein the abnormal user identification device is connected to multiple hosts for communication at the same time; the abnormal user identification device is used to execute an abnormal user identification method.

[0148] Specifically, a computer cluster is a system of multiple nodes connected by a network, which can work together to complete specific tasks.

[0149] The computer cluster 120 includes multiple hosts, including the target host 110 of the target user.

[0150] The abnormal user identification device 130 is connected to multiple hosts for communication, and the abnormal user identification device and a big data platform based on a computer cluster are used for coordinated processing to achieve the effect of identifying abnormal users and their abnormal operations.

[0151] The abnormal user identification system provided in this embodiment can execute the abnormal user identification method of the above embodiment. Its implementation principle and technical effect are similar and will not be described in detail in this embodiment.

[0152] The embodiment of the present invention can divide the electronic device or the main control device into functional modules according to the above method example. For example, each functional module can be divided according to each function, or two or more functions can be integrated into one processing unit. The above integrated unit can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of modules in the embodiment of the present invention is schematic and is only a logical function division. There may be other division methods in actual implementation.

[0153] Figure 4 This is a schematic diagram of the structure of the abnormal user identification device provided in the embodiment of the present application. Figure 4 As shown, the abnormal user identification device includes: an acquisition operation module 410, a coefficient calculation module 420, a marking operation module 430 and a user determination module 440.

[0154] The operation acquisition module 410 is used to acquire multiple normal operations and multiple abnormal operations of the target user within a first preset period of time, and the device hardware information of the target host within the first preset period of time; wherein the target host is the host operated by the target user in the computer cluster;

[0155] The coefficient calculation module 420 is used to calculate the abnormal coefficient of the target host in the corresponding second preset time period according to the device hardware information of the target host within each second preset time period; wherein each second preset time period refers to a time period in which the target user performs a normal operation;

[0156] The marking operation module 430 is used to determine the normal operation corresponding to the second preset period in which the abnormal coefficient is greater than the preset coefficient as an error marking operation; wherein each error marking operation refers to an operation that is marked as a normal operation but is actually an abnormal operation;

[0157] The user determination module 440 is used to determine whether the target user is an abnormal user according to the number of multiple abnormal operations and the number of multiple error marking operations.

[0158] In a possible design, the third preset time period is any one of a plurality of second preset time periods;

[0159] For the second preset time period, the coefficient calculation module 520 includes:

[0160] A numerical calculation module, used to calculate the average value of the hardware usage increase rate and the temperature fluctuation coefficient of the target host in the third preset time period according to the device hardware information of the target host within the third preset time period;

[0161] The abnormal coefficient calculation module is used to calculate the abnormal coefficient of the target host in the third preset time period according to the average value of the hardware usage increase rate and the temperature fluctuation coefficient of the target host in the third preset time period.

[0162] In a possible design, the numerical calculation module includes:

[0163] The utilization rate calculation module is used to obtain the hardware utilization rate hdt of the i-th hardware of the n hardware of the target host at time t1 according to the device hardware information of the target host within the third preset time period. 1i , at time t2, the respective hardware utilization rate hdt 2i , and a temperature change Tt of the processor of the target host within a third preset period; wherein time t1 is the time when the third preset period starts, and time t2 is the time when the third preset period ends;

[0164] Mean calculation module, used to calculate the mean value according to hdt 1i 、hdt 2i and Tt, calculate the hardware usage increase rate average PJ and temperature fluctuation coefficient TFC of the target host in the third preset time period.

[0165] In a possible design, the mean value calculation module includes:

[0166] The rate average module is used to use the rising rate average formula through hardware, according to hdt 1i and hdt 2i , calculate PJ; the formula for the average rise rate of hardware usage is:

[0167]

[0168] The temperature coefficient module is used to calculate TFC based on Tt using the temperature floating coefficient formula; the temperature floating coefficient formula is:

[0169]

[0170] Among them, [t x , t y ] is the voltage warning period in the third preset period; [t m , t n ] is the fan speed warning period in the third preset period.

[0171] In a possible design, the abnormal coefficient calculation module includes:

[0172] The calculation module is used to calculate the abnormal coefficient YC of the target host in the third preset time period according to the abnormal coefficient formula based on PJ and TFC; the abnormal coefficient formula is:

[0173]

[0174] Wherein, a and b are both preset proportional coefficients.

[0175] In one possible design, the user determination module 440 includes:

[0176] The number ratio determination module is used to determine the actual abnormal operation ratio tr according to the number of multiple abnormal operations ts, the number of multiple error marking operations tz, and the total number of operations tn; wherein the formula of tr is:

[0177]

[0178] The determination module is used to determine the target user as an abnormal user when the actual ratio of abnormal operations is greater than a preset ratio.

[0179] In a possible design, the acquisition operation module 410 includes:

[0180] An information table module, used to obtain a resource information table and an operation information table of a target user within a first preset time period; wherein the resource information table includes the access rights of the target user, and the operation information table includes multiple operations of the target user;

[0181] The comparison and matching module is used to compare and match the resource information table and the operation information table, mark the successfully matched operation as a normal operation, and mark the failed matched operation as an abnormal operation.

[0182] The abnormal user identification device provided in this embodiment can execute the abnormal user identification method of the above embodiment. Its implementation principle and technical effect are similar, and this embodiment will not be repeated here.

[0183] In a specific implementation of the aforementioned abnormal user identification method, each module may be implemented as a processor, and the processor may execute computer-executable instructions stored in a memory, so that the processor executes the aforementioned abnormal user identification method.

[0184] Figure 5 This is a schematic diagram of the structure of the electronic device hardware provided in the embodiment of the present application. Figure 5 As shown, the electronic device includes: at least one processor 510 and a memory 520. The electronic device also includes a communication component 530. The processor 510, the memory 520 and the communication component 530 are connected via a bus 540.

[0185] In the specific implementation process, at least one processor 510 executes the computer execution instructions stored in the memory 520, so that at least one processor 510 executes an abnormal user identification method executed by the electronic device side as above.

[0186] The specific implementation process of the processor 510 can be found in the above method embodiment, and its implementation principle and technical effect are similar, so this embodiment will not be repeated here.

[0187] In the above embodiments, it should be understood that the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the invention may be directly implemented as being executed by a hardware processor, or may be executed by a combination of hardware and software modules in the processor.

[0188] The memory may include a high-speed RAM memory, and may also include a non-volatile storage NVM, such as at least one disk storage.

[0189] The bus may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, the bus in the drawings of the present application is not limited to only one bus or one type of bus.

[0190] The above-mentioned functions implemented by the electronic device and the main control device introduce the scheme provided by the embodiment of the present invention. It can be understood that in order to implement the above-mentioned functions, the electronic device or the main control device includes a hardware structure and / or software module corresponding to the execution of each function. In combination with the units and algorithm steps of each example described in the embodiment disclosed in the embodiment of the present invention, the embodiment of the present invention can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the technical solution of the embodiment of the present invention.

[0191] The present application also provides a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the above-mentioned abnormal user identification method.

[0192] The above-mentioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof.

[0193] Such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Read Only Memory (PROM), Read Only Memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk. The readable storage medium can be any available medium that can be accessed by a general or special purpose computer.

[0194] An exemplary readable storage medium is coupled to a processor so that the processor can read information from the readable storage medium and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can be located in an application specific integrated circuit (Application Specific Integrated Circuits, referred to as: ASIC). Of course, the processor and the readable storage medium can also exist as discrete components in an electronic device or a main control device.

[0195] The present application also provides a computer program product, which includes: a computer program, which is stored in a readable storage medium. At least one processor of an electronic device can read the computer program from the readable storage medium. When the computer program is executed by the processor, it is used to implement the above-mentioned abnormal user identification method.

[0196] Those skilled in the art can understand that all or part of the steps of the above method embodiments can be completed by hardware related to program instructions. The above program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above method embodiments are executed; and the above storage medium includes: ROM, RAM, disk or optical disk and other media that can store program codes.

[0197] So far, the technical solution of the present application has been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it is easy for those skilled in the art to understand that the protection scope of the present application is obviously not limited to these specific embodiments, and the above embodiments are only used to illustrate the technical solution of the present application rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein by equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for identifying abnormal users, characterized in that: The method comprises: Acquire multiple normal operations and multiple abnormal operations of a target user within a first preset period of time, and device hardware information of a target host within the first preset period of time; wherein the target host is a host operated by the target user in a computer cluster; Calculate the abnormal coefficient of the target host in the corresponding second preset time period according to the device hardware information of the target host within each second preset time period; wherein each second preset time period refers to a time period in which the target user performs the normal operation once; Determine the normal operation corresponding to the second preset period in which the abnormal coefficient is greater than the preset coefficient as an error-marked operation; wherein each of the error-marked operations refers to an operation that is marked as a normal operation but is actually an abnormal operation; Whether the target user is an abnormal user is determined according to the number of the multiple abnormal operations and the number of the multiple error marking operations.

2. The abnormal user identification method according to claim 1, characterized in that: The third preset time period is any one of the plurality of the second preset time periods; For the second preset time period, calculating the abnormality coefficient of the target host in the corresponding second preset time period according to the device hardware information of the target host within each second preset time period includes: Calculating the hardware usage increase rate mean and the temperature fluctuation coefficient of the target host in the third preset time period according to the device hardware information of the target host within the third preset time period; An abnormality coefficient of the target host in the third preset time period is calculated according to the average value of the hardware usage increase rate and the temperature fluctuation coefficient of the target host in the third preset time period.

3. The abnormal user identification method according to claim 2, characterized in that: The step of calculating the hardware usage increase rate mean and the temperature fluctuation coefficient of the target host in the third preset time period according to the device hardware information of the target host in the third preset time period includes: According to the device hardware information of the target host within the third preset time period, the hardware usage rate hdt of the i-th hardware of the n hardware of the target host at time t1 is obtained. 1i , at time t2, the respective hardware utilization rate hdt 2i , and a temperature change Tt of the processor of the target host within the third preset period; wherein the time t1 is the time when the third preset period starts, and the time t2 is the time when the third preset period ends; According to the hdt 1i 、The hdt 2i and Tt, calculate the hardware usage rising rate mean PJ and the temperature fluctuation coefficient TFC of the target host in the third preset time period.

4. The abnormal user identification method according to claim 3, characterized in that: According to the hdt 1i 、The hdt 2i and Tt, calculating the hardware usage increase rate mean PJ and the temperature fluctuation coefficient TFC of the target host in the third preset time period, including: The hardware uses the rise rate mean formula, according to the hdt 1i and the hdt 2i , calculate the PJ; the hardware uses the mean rise rate formula as follows: The TFC is calculated according to the Tt by using the temperature floating coefficient formula; the temperature floating coefficient formula is: Among them, [t x , t y ] is the voltage warning period in the third preset period; [t m , t n ] It is the fan speed warning period in the third preset period.

5. The abnormal user identification method according to claim 4, characterized in that: The calculating the abnormal coefficient of the target host in the third preset period according to the mean value of the hardware usage increase rate and the temperature fluctuation coefficient of the target host in the third preset period includes: The abnormal coefficient YC of the target host in the third preset time period is calculated according to the PJ and the TFC through the abnormal coefficient formula; the abnormal coefficient formula is: Wherein, said a and said b are both preset proportional coefficients.

6. The abnormal user identification method according to claim 1, characterized in that: The determining whether the target user is an abnormal user according to the number of the multiple abnormal operations and the number of the multiple error marking operations includes: According to the number of the plurality of abnormal operations ts, the number of the plurality of error marking operations tz, and the total number of operations tn, the actual abnormal operation ratio tr is determined; wherein the formula of the tr is: When the actual ratio of abnormal operations is greater than a preset ratio, the target user is determined as an abnormal user.

7. The abnormal user identification method according to claim 1, characterized in that: The obtaining of multiple normal operations and multiple abnormal operations of the target user within the first preset time period includes: Acquire a resource information table and an operation information table of the target user within the first preset time period; wherein the resource information table includes the access rights of the target user, and the operation information table includes multiple operations of the target user; The resource information table and the operation information table are compared and matched, and the operations that are successfully matched are marked as the normal operations, and the operations that fail to match are marked as the abnormal operations.

8. An abnormal user identification system, characterized in that: The system comprises: A computer cluster, wherein the computer cluster includes a plurality of hosts; Abnormal user identification device; wherein, the abnormal user identification device is simultaneously connected to the multiple hosts for communication; the abnormal user identification device is used to execute an abnormal user identification method as described in any one of claims 1 to 7.

9. An abnormal user identification device, characterized in that: The device comprises: An operation acquisition module is used to acquire multiple normal operations and multiple abnormal operations of a target user within a first preset period of time, and device hardware information of a target host within the first preset period of time; wherein the target host is a host operated by the target user in a computer cluster; A coefficient calculation module, used to calculate the abnormal coefficient of the target host in the corresponding second preset time period according to the device hardware information of the target host within each second preset time period; wherein each second preset time period refers to a time period in which the target user performs the normal operation once; A marking operation module, used to determine the normal operation corresponding to the second preset time period in which the abnormal coefficient is greater than the preset coefficient as an error marking operation; wherein each of the error marking operations refers to an operation that is marked as a normal operation but is actually an abnormal operation; The user determination module is used to determine whether the target user is an abnormal user according to the number of the multiple abnormal operations and the number of the multiple error marking operations.

10. An electronic device comprising: A processor, and a memory communicatively connected to the processor; Memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the abnormal user identification method described in any one of claims 1 to 7.

Images