Security monitoring implementation method and system based on data business process

Abstract

The embodiment of the invention provides a security monitoring implementation method and system based on a data business process, and the method comprises the steps: collecting system data of business processing, setting a system performance index based on the system data, and generating a business rule base corresponding to the system performance index; carrying out point burying on business flow nodes involved in business processing, carrying out data analysis on point burying logs through a business rule base, determining key attributes in the point burying logs, generating dynamic thresholds corresponding to the key attributes, and updating the business rule base; the event tracking logs are screened through the updated service rule base, fault marking is carried out on data which do not accord with the rule, and a recheck period and an alarm mechanism of the fault marking are set; and constructing a call chain of the buried point log, and generating a corresponding graphical display result based on the call chain.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a method and system for implementing security monitoring based on data business processes. Background Art

[0002] With the development of information systems, data is constantly being gathered in the business processing of various industries, and large data centers are constantly being built. As the business scale continues to increase, the data processing scale gradually becomes larger, the data processing link continues to become longer, and the business changes frequently, the data processing link is becoming more and more complex.

[0003] In the face of the above situation, the primary issue is how to quickly find the location of the fault in the huge data processing chain of data aggregation, governance, sharing, and openness, and enable the system to automatically track the responsible party for the fault.

[0004] In response to the above problems, at present, when a problem occurs in a data link, log tracing is often done manually, or interface parameter transmission and embedded point logs are checked to find the root cause of the problem. This not only brings a large workload, but also makes it difficult to find the root cause of the problem. Summary of the invention

[0005] In view of the problems existing in the prior art, an embodiment of the present invention provides a method and system for implementing security monitoring based on data business processes.

[0006] An embodiment of the present invention provides a method for implementing security monitoring based on a data service process, the method comprising: Collecting system data for business processing, setting system performance indicators based on the system data, and generating a business rule library corresponding to the system performance indicators; Tracking the business flow nodes involved in the business processing, parsing the tracking logs through the business rule library, determining the key attributes in the tracking logs, generating dynamic thresholds corresponding to the key attributes, and updating the business rule library; The tracking logs are screened through the updated business rule library, fault marks are made for data that does not conform to the rules, and a recheck cycle and alarm mechanism for the fault marks are set; Construct a call chain of the tracking log, and generate a corresponding graphical display result based on the call chain.

[0007] In one embodiment, the method further comprises: When the business flow node is tracking, an event model is added, and the event model includes authority authentication and log recording matters; The authority authentication includes configuring custom users, establishing the authority service business layer, user authorization, and query verification.

[0008] In one embodiment, the method further comprises: The event model includes a user class model and an event class model; The user class model records the current user attributes and user permissions, verifies the user permissions, and records the verification results in the corresponding embedding log; The event model collects statistics on various performance indicators of the system data and records them in the tracking log.

[0009] In one embodiment, the method further comprises: Interface call volume, interface time consumption, abnormal status, server connection status and permission verification failure rate.

[0010] In one embodiment, the method further comprises: When recording the tracking log, TraceID and Span are collected, and the Span under the TraceID is arranged in chronological order to form a timeline. The call chain of the tracking log is constructed by combining the parent-child relationship between each Span.

[0011] In one embodiment, the method further comprises: Interface call time, interface server connection status, interface call status, daily interface call volume, database access exception status, number of permission checks, data exchange volume, and server connection status.

[0012] An embodiment of the present invention provides a security monitoring implementation system based on a data service process, the system comprising: A rule module is used to collect system data for business processing, set system performance indicators based on the system data, and generate a business rule library corresponding to the system performance indicators; A tracking module is used to track the business flow nodes involved in the business processing, perform data analysis on the tracking logs through the business rule library, determine the key attributes in the tracking logs, generate dynamic thresholds corresponding to the key attributes, and update the business rule library; A fault module is used to filter the tracking logs through the updated business rule library, mark the data that does not meet the rules as faults, and set the recheck cycle and alarm mechanism of the fault marks; The display module is used to construct a call chain of the tracking log and generate a corresponding graphical display result based on the call chain.

[0013] In one embodiment, the system further comprises: The call chain module is used to collect TraceID and Span when recording the tracking log, arrange the Span under the TraceID in chronological order to form a timeline, and build the call chain of the tracking log in combination with the parent-child relationship between each Span.

[0014] An embodiment of the present invention provides an electronic device, including a processor and a memory; The processor is connected to the memory; The memory is used to store executable program code; The processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, so as to execute the method described in one or more embodiments.

[0015] An embodiment of the present invention provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned method for implementing security monitoring based on data business processes are implemented.

[0016] In view of the above, in one or more embodiments of the present specification, the system data of business processing is collected, the system performance indicators are set based on the system data, and the business rule library corresponding to the system performance indicators is generated; the business flow nodes involved in the business processing are buried, and the buried logs are analyzed through the business rule library to determine the key attributes in the buried logs, and the dynamic thresholds corresponding to the key attributes are generated to update the business rule library; the buried logs are screened through the updated business rule library, and the data that does not conform to the rules is marked as faults, and the re-inspection cycle and alarm mechanism of the fault marks are set; the call chain of the buried log is constructed, and the corresponding graphical display results are generated based on the call chain. In this way, the rule library can be constructed through monitoring indicators, combined with the early warning methods of buried monitoring and log analysis, to quickly discover the current data link failure and issue early warnings to the relevant responsible persons, greatly improving the security and stability of the entire data processing link. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0018] Figure 1 This is a flowchart of a method for implementing security monitoring based on data business processes provided by an embodiment of this specification.

[0019] Figure 2It is a process sequence diagram of a method for implementing security monitoring based on a data business process provided by an embodiment of this specification.

[0020] Figure 3 It is a structural diagram of a security monitoring implementation system based on data business processes provided by an embodiment of this specification.

[0021] Figure 4 It is a structural schematic diagram of an electronic device provided by an embodiment of this specification. DETAILED DESCRIPTION

[0022] The subject matter described herein will now be discussed with reference to example embodiments. It should be understood that the discussion of these embodiments is only to enable those skilled in the art to better understand and implement the subject matter described herein, and is not a limitation of the scope of protection, applicability or examples set forth in the claims. The functions and arrangements of the elements discussed can be changed without departing from the scope of protection of the contents of this specification. Various examples can omit, replace or add various processes or components as needed. For example, the described method can be performed in an order different from the described order, and various steps can be added, omitted or combined. In addition, the features described relative to some examples can also be combined in other examples.

[0023] As used herein, the term "including" and its variations represent open terms, meaning "including but not limited to". The term "based on" means "based at least in part on". The terms "one embodiment" and "an embodiment" mean "at least one embodiment". The term "another embodiment" means "at least one other embodiment". The terms "first", "second", etc. may refer to different or the same objects. Other definitions may be included below, whether explicit or implicit. Unless the context clearly indicates otherwise, the definition of a term is consistent throughout the specification.

[0024] like Figure 1 As shown, an embodiment of the present invention provides a method for implementing security monitoring based on a data service process, including: Step S101 : collecting system data of business processing, setting system performance indicators based on the system data, and generating a business rule library corresponding to the system performance indicators.

[0025] Specifically, when processing related businesses, the business system based on informatization creates system data corresponding to various types of businesses according to the actual businesses being processed, and then conducts quantitative evaluation of the system data to determine basic indicators that can directly reflect the health status and service quality of the business system. Among them, the basic indicators of the system may include but are not limited to: interface call time, which measures the API response speed and is an important indicator of user experience and system performance; interface server connection status bit, which checks whether the API server is online normally, and non-zero may mean that there is a connection problem; interface call status bit, which reflects the success or failure of the API request and helps identify the source of the error; interface call volume on the same day, which counts the number of daily API calls, which is used to evaluate service usage and trend analysis; database access abnormal status bit, which monitors abnormalities in database operations, such as timeouts, denial of service, etc.; permission check times, which records the number of times in the authentication and authorization process to ensure security and compliance; data exchange volume, which measures the total amount of data transmitted in a specific time period, and helps understand bandwidth usage; server connection status: ensure that all relevant servers are in good working condition.

[0026] Furthermore, after determining the basic indicators, corresponding rules are generated to automatically detect potential problems with the basic indicators, so as to determine whether the current system's operating status meets expectations through predefined conditions. Among them, based on the basic indicators, the rules in the corresponding rule library may include but are not limited to: whether the interface call time is greater than the default value, that is, whether the API response time exceeds the set threshold; the interface deployment server connection status is non-zero; the interface call volume exceeds the limit, and a reasonable call frequency upper limit is set; the interface call volume exceeds the threshold in a single month; the data node involves a deployment server status that is non-zero. In the process of building rules, the basic indicators and corresponding business rules can be flexibly adjusted according to business needs.

[0027] Step S102, tracking the business flow nodes involved in the business processing, parsing the tracking logs through the business rule library, determining the key attributes in the tracking logs, generating dynamic thresholds corresponding to the key attributes, and updating the business rule library.

[0028] Specifically, detect the business flow nodes involved in the business processing process. Before detecting the business flow nodes, the database or interface is connected for various data of the system or components in the business processing process to meet the interaction requirements between different systems or components. After completing the database or interface connection, when the system processes the business, the business flow nodes on the data link are buried. Among them, the business flow nodes are key data nodes, such as data entry, exit, important processing steps and other nodes, and the buried points are used to collect data flow information of the business. And when designing the buried points, it is necessary to minimize the impact on the existing business logic.

[0029] Furthermore, in order to enable tracking points to record business processes and audit data problems, an event model can be added to the tracking points. The event model provides two items: permission authentication and log recording. The permission verification in the data processing process and the log indicator recording of key process data are realized. Among them, permission authentication includes integrated identity authentication, authorization verification for each request; fine-grained control, assigning different permission levels according to different roles and responsibilities to achieve more refined access control; dynamic adjustment, dynamically adjusting the permission verification standard according to different business rules.

[0030] The event model may include a user class model and an event class model. The current user attributes and application permissions are recorded in the user class for permission verification. If the permission verification succeeds or fails, it will be recorded in the corresponding node's tracking log. The event class provides a logging function to count various indicators in the corresponding fields of the log: such as interface time consumption, interface server abnormality, interface call volume, etc. Then the relevant data is recorded in the log table.

[0031] Furthermore, the permission verification of the tracking point mainly includes four verification steps: configuring custom users, establishing the permission service business layer, user authorization, and query verification. Because the operation of the database table needs to be based on the database user to log in, the custom user configuration is required first. Create a test user class, set the user configuration class encryption password, and complete the custom user configuration. Establish the permission service business layer through the underlying framework of the system, and use the service business layer to establish a configuration file. When the system performs permission verification, the service layer will obtain permission information such as the user name and record it in the configuration file. Establish a control business layer to authorize the user. Finally, query verification, through the jar package, add the application configuration file, and verify the user information through the Mapping layer. If the verification is illegal, the error flag will be written to the log.

[0032] The records of tracking logs include operations, status changes, data, etc. in the business processing process, all of which can be recorded. The content of the log can contain sufficient contextual information, such as timestamp, user ID, operation type, result status, etc., to facilitate analysis in subsequent steps.

[0033] Furthermore, after recording the tracking log, the log data is parsed by loading the rule base. The specific parsing process can parse the log data one by one through the conditions in the rule base to check whether there are any violations of the rules. For example, detect whether the interface call time exceeds the set threshold, confirm whether the server connection status is normal, and verify whether there is a failure record for permission verification. When parsing the data of the tracking log, the key attributes in the tracking log can be determined, that is, data that can directly reflect the health status and service quality of the system, usually including but not limited to: interface call volume, interface time, abnormal status, server connection status, permission verification failure rate, etc. Then, you can use visualization tools (such as Grafana, Kibana, etc.) to create a real-time updated dashboard to show the changing trend of key attributes. During the display process, you can also set a reasonable threshold range for each key attribute and flexibly adjust it according to business needs. When the monitored data exceeds the preset range, an alarm is automatically triggered and the relevant responsible person is notified.

[0034] Step S103, screening the tracking point logs through the updated business rule library, marking the data that does not comply with the rules as faults, and setting the recheck cycle and alarm mechanism of the fault marks.

[0035] Specifically, the tracking logs are screened through the updated business rule library, wherein, before each screening, that is, before comparing the rules with the log data, the rule library is updated to determine whether there are the latest rules. Then, the log entries that need to be analyzed can be read from the log database in batch processing, reducing the number of I / O operations and improving efficiency. For each log record, check each item to verify whether the corresponding rules are met. When a situation that does not comply with the rules is detected, the location that does not comply with the rules is determined, and then the data that does not comply with the rules is marked as a fault. The fault flag field may include but is not limited to error_flag (Boolean value), error_code (integer), error_message (string) and other designs, and an index is created for the fault flag field to speed up the subsequent query speed for the fault flag.

[0036] Furthermore, after designing the fault flag, you can use certain scheduling tools (such as distributed scheduling frameworks such as Apache Airflow) to schedule recheck tasks for the fault flag and set the recheck cycle. You can set a reasonable detection frequency (such as every minute, every hour, etc.) according to business needs to balance the response speed and system load.

[0037] In addition, when rechecking the fault flag, the corresponding SQL query statement of the fault flag can be used to find the log records with the fault flag. In order to avoid repeated detection, only the newly added data entries since the last run are detected each time, such as filtering data entries by timestamp.

[0038] Furthermore, for the fault flag detection task, an alarm mechanism can be designed accordingly after the fault occurs, including but not limited to the alarm level, recipient, notification method, etc., so that the system's alarm information can be quickly and accurately notified to the corresponding recipient.

[0039] Step S104, constructing a call chain of the tracking log, and generating a corresponding graphical display result based on the call chain.

[0040] Specifically, when recording data in the tracking log, the TraceID (tracking ID) is collected, that is, each request will be assigned a unique TraceID from entering the system to the final completion, which runs through the entire call chain, and span, and each service call or operation is recorded as a Span, including start time, end time, operation name and other information. Then all spans under the same TraceID are arranged in chronological order to form a timeline, which intuitively shows the execution order and time consumption of each operation. And determine the parent-child relationship between each span, build a complete call stack (Call Stack), and thus determine the call chain of the tracking log.

[0041] Furthermore, for the graphical display of the call chain, you can choose a distributed tracing system (such as Jaeger, Zipkin) or a custom-developed dashboard and other tools to achieve graphical display. When displaying, use different colors or icons to highlight time-consuming operations, abnormal calls, or failed service nodes in the graphical interface to help users quickly identify problem areas. For graphical data, real-time data refresh should be performed to ensure that users always see the latest call chain status. The focus of the refresh includes but is not limited to during troubleshooting.

[0042] In this embodiment, the timing diagram of the method for implementing security monitoring based on data service flow can be as follows: Figure 2As shown, for the full-link data supervision of each system during business processing, including the database, backend, and frontend, on the database side, establish a data aggregation table for each system and component, and then perform system tracking for the business flow nodes on the backend. The library table must be updated before the tracking is executed. After the tracking is authorized and verified, data logs are recorded. Correspondingly, the backend establishes an indicator rule library, and on the premise of establishing a link monitoring task, loads the rule library, performs log analysis under the guidance of the rule library, and determines the rule service of the log analysis results, such as system alarms. And build a call chain for the tracking log, and generate corresponding graphical display results based on the call chain.

[0043] The embodiment of the present invention provides a method for implementing security monitoring based on data business processes, which collects system data for business processing, sets system performance indicators based on system data, and generates a business rule library corresponding to the system performance indicators; performs point tracking on business flow nodes involved in business processing, performs data analysis on the point tracking log through the business rule library, determines the key attributes in the point tracking log, generates dynamic thresholds corresponding to the key attributes, and updates the business rule library; screens the point tracking log through the updated business rule library, marks the data that does not conform to the rules as a fault, and sets the re-inspection cycle and alarm mechanism of the fault mark; constructs a call chain for the point tracking log, and generates corresponding graphical display results based on the call chain. In this way, the rule library can be constructed through monitoring indicators, combined with the early warning method of point tracking monitoring and log analysis, to quickly discover the current data link failure and issue an early warning to the relevant responsible person, greatly improving the security and stability of the entire data processing link. .

[0044] See also Figure 3 , Figure 3 Schematic diagram of a security monitoring system based on data business process provided by the embodiment of the present application. Figure 3 As shown, the system comprises: The rule module S301 is used to collect system data for business processing, set system performance indicators based on the system data, and generate a business rule library corresponding to the system performance indicators; The tracking module S302 is used to track the business flow nodes involved in the business processing, perform data analysis on the tracking logs through the business rule library, determine the key attributes in the tracking logs, generate dynamic thresholds corresponding to the key attributes, and update the business rule library; The fault module S303 is used to filter the tracking logs through the updated business rule library, mark the data that does not meet the rules as faults, and set the recheck cycle and alarm mechanism of the fault marks; The display module S304 is used to construct a call chain of the tracking log and generate a corresponding graphical display result based on the call chain.

[0045] In another embodiment, a security monitoring implementation system based on data business process further includes: The call chain module is used to collect TraceID and Span when recording the tracking log, arrange the Span under the TraceID in chronological order to form a timeline, and build the call chain of the tracking log in combination with the parent-child relationship between each Span.

[0046] Those skilled in the art can clearly understand that the technical solutions of the embodiments of the present application can be implemented with the help of software and / or hardware. The "unit" and "module" in this specification refer to software and / or hardware that can independently complete or cooperate with other components to complete specific functions, where the hardware can be, for example, a field programmable gate array (FPGA), an integrated circuit (IC), etc.

[0047] Each processing unit and / or module of the embodiments of the present application may be implemented by an analog circuit that implements the functions described in the embodiments of the present application, or may be implemented by software that executes the functions described in the embodiments of the present application.

[0048] See also Figure 4 , which shows a schematic diagram of the structure of an electronic device involved in an embodiment of the present application, the electronic device can be used to implement Figure 1 The method in the embodiment shown. Figure 4 As shown, the electronic device 400 may include: at least one processor 401 , at least one network interface 404 , a user interface 403 , a memory 405 , and at least one communication bus 402 .

[0049] The communication bus 402 is used to realize the connection and communication between these components.

[0050] The user interface 403 may include a display screen (Display) and a camera (Camera). Optionally, the user interface 403 may also include a standard wired interface and a wireless interface.

[0051] The network interface 404 may optionally include a standard wired interface or a wireless interface (such as a WI-FI interface).

[0052] Among them, the processor 401 may include one or more processing cores. The processor 401 uses various interfaces and lines to connect various parts of the entire electronic device 400, and executes various functions and processes data of the terminal 400 by running or executing instructions, programs, code sets or instruction sets stored in the memory 405, and calling data stored in the memory 405. Optionally, the processor 401 can be implemented in at least one hardware form of digital signal processing (Digital Signal Processing, DSP), field programmable gate array (Field-ProgrammableGate Array, FPGA), and programmable logic array (ProgrammableLogic Array, PLA). The processor 401 can integrate one or a combination of a processor (CentralProcessing Unit, CPU), an image processor (Graphics Processing Unit, GPU) and a modem. Among them, the CPU mainly processes the operating system, user interface and application programs; the GPU is responsible for rendering and drawing the content to be displayed on the display screen; and the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 401, and it can be implemented separately through a chip.

[0053] Among them, the memory 405 may include a random access memory (Random Access Memory, RAM) and may also include a read-only memory (Read-Only Memory). Optionally, the memory 405 includes a non-transitory computer-readable storage medium. The memory 405 can be used to store instructions, programs, codes, code sets or instruction sets. The memory 405 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the above-mentioned various method embodiments, etc.; the data storage area may store data involved in the above-mentioned various method embodiments, etc. The memory 405 may also be optionally at least one storage device located away from the aforementioned processor 401. As Figure 4 As shown, the memory 405 as a computer storage medium may include an operating system, a network communication module, a user interface module, and program instructions.

[0054] exist Figure 4In the electronic device 400 shown, the user interface 403 is mainly used to provide an input interface for the user and obtain the data input by the user; and the processor 401 can be used to call the image-generated interactive application stored in the memory 405, and perform the following operations: collect system data for business processing, set system performance indicators based on the system data, and generate a business rule library corresponding to the system performance indicators; perform point tracking on the business flow nodes involved in the business processing, perform data analysis on the point tracking log through the business rule library, determine the key attributes in the point tracking log, and generate dynamic thresholds corresponding to the key attributes, and update the business rule library; screen the point tracking log through the updated business rule library, mark the data that does not comply with the rules as a fault, and set the re-inspection cycle and alarm mechanism of the fault mark; build a call chain for the point tracking log, and generate corresponding graphical display results based on the call chain.

[0055] The present application also provides a computer-readable storage medium on which a computer program is stored, and when the program is executed by a processor, the steps of the above method are implemented. The computer-readable storage medium may include, but is not limited to, any type of disk, including a floppy disk, an optical disk, a DVD, a CD-ROM, a micro drive, and a magneto-optical disk, a ROM, a RAM, an EPROM, an EEPROM, a DRAM, a VRAM, a flash memory device, a magnetic card or an optical card, a nanosystem (including a molecular memory IC), or any type of medium or device suitable for storing instructions and / or data.

[0056] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

[0057] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0058] In the several embodiments provided in the present application, it should be understood that the disclosed devices can be implemented in other ways. For example, the device embodiments described above are only schematic, such as the division of the units, which is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some service interfaces, and the indirect coupling or communication connection of devices or units can be electrical or other forms.

[0059] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0060] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0061] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable memory. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a memory, including a number of instructions to enable a computer device (which can be a personal computer, server or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned memory includes: U disk, read-only memory (ROM), random access memory (RAM), mobile hard disk, disk or optical disk and other media that can store program codes.

[0062] A person skilled in the art may understand that all or part of the steps in the various methods of the above embodiments may be completed by entering a program to instruct related hardware, and the program may be stored in a computer-readable memory, which may include a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0063] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

Claims

1. A method for implementing security monitoring based on a data business process, the method comprising: Collecting system data for business processing, setting system performance indicators based on the system data, and generating a business rule library corresponding to the system performance indicators; Tracking the business flow nodes involved in the business processing, parsing the tracking logs through the business rule library, determining the key attributes in the tracking logs, generating dynamic thresholds corresponding to the key attributes, and updating the business rule library; The tracking logs are screened through the updated business rule library, fault marks are made for data that does not conform to the rules, and a recheck cycle and alarm mechanism for the fault marks are set; Construct a call chain of the tracking log, and generate a corresponding graphical display result based on the call chain.

2. The method according to claim 1, characterized in that The tracking of the business flow nodes involved in the business processing includes: When the business flow node is tracking, an event model is added, and the event model includes authority authentication and log recording matters; The authority authentication includes configuring custom users, establishing the authority service business layer, user authorization and query verification.

3. The method according to claim 2, characterized in that The method further comprises: The event model includes a user class model and an event class model; The user class model records the current user attributes and user permissions, verifies the user permissions, and records the verification results in the corresponding embedding log; The event model collects statistics on various performance indicators of the system data and records them in the tracking log.

4. The method according to claim 1, characterized in that: The key attributes include: Interface call volume, interface time consumption, abnormal status, server connection status and permission verification failure rate.

5. The method according to claim 1, characterized in that: The call chain for constructing the tracking log includes: When recording the tracking log, TraceID and Span are collected, and the Span under the TraceID is arranged in chronological order to form a timeline. The call chain of the tracking log is constructed by combining the parent-child relationship between each Span.

6. The method according to claim 1, characterized in that The system performance indicators include: Interface call time, interface server connection status, interface call status, daily interface call volume, database access exception status, number of permission checks, data exchange volume, and server connection status.

7. A security monitoring implementation system based on data business process, characterized in that: The system comprises: A rule module is used to collect system data for business processing, set system performance indicators based on the system data, and generate a business rule library corresponding to the system performance indicators; A tracking module is used to track the business flow nodes involved in the business processing, perform data analysis on the tracking logs through the business rule library, determine the key attributes in the tracking logs, generate dynamic thresholds corresponding to the key attributes, and update the business rule library; A fault module is used to filter the tracking logs through the updated business rule library, mark the data that does not meet the rules as faults, and set the recheck cycle and alarm mechanism of the fault marks; The display module is used to construct a call chain of the tracking log and generate a corresponding graphical display result based on the call chain.

8. The system according to claim 7, characterized in that The system further comprises: The call chain module is used to collect TraceID and Span when recording the tracking log, arrange the Span under the TraceID in chronological order to form a timeline, and build the call chain of the tracking log in combination with the parent-child relationship between each Span.

9. An electronic device comprising a processor and a memory; The processor is connected to the memory; The memory is used to store executable program code; The processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, so as to execute the method according to any one of claims 1 to 6.

10. A computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the method according to any one of claims 1 to 6 when executed by a processor.

Images