Alarm data evaluation method of server, electronic equipment and storage medium

Abstract

The invention relates to the technical field of data processing, in particular to an alarm data evaluation method of a server, electronic equipment and a storage medium, and the method comprises the steps: obtaining the alarm frequency of each target level corresponding to data processing in a target server and the alarm frequency corresponding to each alarm level in each target level, then, respectively obtaining an alarm weight corresponding to each target level and an alarm weight corresponding to each alarm level in each target level, calculating the obtained parameters to obtain an initial alarm index corresponding to each target level, and according to the alarm weight corresponding to each target level and the initial alarm index corresponding to each target level, calculating the alarm weight corresponding to each target level and the alarm weight corresponding to each alarm level; obtaining a target alarm index corresponding to each target level; according to the invention, each weight parameter can be automatically adjusted according to the dynamic change of the alarm times, and the system can be ensured to automatically calculate reasonable alarm data, so that the safety risk of the system can be evaluated more accurately and timely.

Description

Technical Field

[0001] The present invention relates to the technical field of data processing, and in particular, to a method for evaluating alarm data of a server, an electronic device, and a storage medium. Background Art

[0002] Currently, the security management center generates a large number of security alarms every day. These alarms come from security components at different levels such as the data layer and the application layer, and are divided into different security levels. For example, low-risk, medium-risk, high-risk, etc. Among these alarms, some faults can be resolved in a timely manner, but there are still some alarms that cannot be processed in a timely manner, which may cause the system to fail to work at any time and affect the normal operation of the system. Therefore, in a multi-layer and multi-level alarm system, with the continuous occurrence of alarm events, it is of great significance to obtain a reasonable alarm index in real time. Summary of the Invention

[0003] In view of the above technical problems, the present invention provides a method for evaluating alarm data of a server, an electronic device, and a storage medium, which can automatically adjust each weight parameter according to the dynamic change of the number of alarms, ensure that the system can automatically calculate reasonable alarm data, and thus more accurately and timely evaluate the security risk of the system.

[0004] According to a first aspect of the present invention, there is provided a method for evaluating alarm data of a server, including the following steps:

[0005] Obtain the number of alarms corresponding to each target level during data processing in the target server and the number of alarms corresponding to each alarm level within each target level according to a preset time period.

[0006] According to the number of alarms corresponding to each target level and the number of alarms corresponding to each alarm level within each target level, respectively obtain the alarm weight corresponding to each target level and the alarm weight corresponding to each alarm level within each target level.

[0007] According to the number of alarms corresponding to each alarm level within each target level and the alarm weight corresponding to each alarm level, respectively perform a weighted sum calculation to obtain the initial alarm index corresponding to each target level.

[0008] According to the alarm weight corresponding to each target level and the initial alarm index corresponding to each target level, obtain the target alarm index corresponding to each target level to output the alarm evaluation data corresponding to the target server.

[0009] According to a second aspect of the present invention, there is provided a non-transitory computer-readable storage medium, in which at least one instruction or at least one program is stored, and the at least one instruction or the at least one program is loaded and executed by a processor to implement the above method for evaluating alarm data of a server.

[0010] According to a third aspect of the present invention, there is provided an electronic device including a processor and the above-mentioned non-transitory computer-readable storage medium.

[0011] The present invention has at least the following beneficial effects:

[0012] The present invention provides a method for evaluating alarm data of a server. First, according to a preset time period, the number of alarms at each target level corresponding to data processing in the target server and the number of alarms corresponding to each alarm level within each target level are obtained. Then, according to the obtained number of alarms, the alarm weight corresponding to each target level and the alarm weight corresponding to each alarm level within each target level are respectively obtained. In this process, the number of alarms at the target level and the weight gain brought by different alarm levels are respectively introduced, making the obtained alarm weight more reasonable. Then, the obtained parameters are calculated to obtain the initial alarm index corresponding to each target level. According to the alarm weight corresponding to each target level and the initial alarm index corresponding to each target level, the target alarm index corresponding to each target level is obtained. The present invention can automatically adjust each weight parameter according to the dynamic change of the number of alarms, ensure that the system can automatically calculate reasonable alarm data, and thus more accurately and timely evaluate the security risk of the target server. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following will briefly introduce the drawings required for the description of the embodiments. Obviously, the following drawings are only some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0014] Figure 1 It is a flowchart of the method for evaluating alarm data of the server provided by the embodiment of the present invention;

[0015] Figure 2 It is a schematic diagram of the overall alarm index of the target server provided by the embodiment of the present invention;

[0016] Figure 3 It is a schematic diagram of the proportion of the alarm index of each alarm level within each target level provided by the embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0017] The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the drawings in the embodiments of the present invention. Obviously, the described embodiments are only some of the embodiments of the present invention, rather than all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative efforts fall within the protection scope of the present invention.

[0018] An embodiment of the present invention provides a method for evaluating alarm data of a server, as Figure 1 shown, the method includes the following steps:

[0019] S100, obtain the alarm times of each target level corresponding to data processing in the target server and the alarm times corresponding to each alarm level within each target level according to a preset time period; it can be understood that: the alarm times refer to the number of alarms issued and not resolved within the preset time period.

[0020] Further, the unit of the preset time period is seconds. For example, in implementation, the alarm times are obtained every 5 seconds, and the evaluated alarm data is refreshed.

[0021] Specifically, the target level refers to any one of the network layer, host layer, application layer, and data layer.

[0022] Further, the alarm levels are set to five levels, namely information, low risk, medium risk, high risk, and emergency. Among them, the alarm levels increase in order from front to back.

[0023] S200, respectively obtain the alarm weight corresponding to each target level and the alarm weight corresponding to each alarm level within each target level according to the alarm times of each target level and the alarm times corresponding to each alarm level within each target level.

[0024] Specifically, the method obtains the alarm weight corresponding to each target level through the following steps:

[0025] S201, calculate the proportion of alarm times of each target level, and respectively use the proportion of alarm times of each target level as x and input it into the preset normalization model y = 4 / (1 + e -x ) - 2 to obtain the weight reference value corresponding to each target level.

[0026] S202, determine the product of the proportion of alarm times of each target level and the weight reference value corresponding to each target level as the initial weight corresponding to each target level.

[0027] Specifically, the initial weight corresponding to the target level meets the following conditions:

[0028] W i =(K i / ∑ m i＝1 K i )×λ i , where, W i is the initial weight corresponding to the i-th target level, K iis the number of alarms for the i-th target level, where the value range of i is from 1 to m, and λ i is the weight reference value corresponding to the i-th target level; in this embodiment, m = 4.

[0029] S203. Normalize the initial weight corresponding to each target level to between 0 and 1 to obtain the alarm weight corresponding to each target level.

[0030] Preferably, the ratio of the initial weight corresponding to each target level to the sum of the initial weights corresponding to all target levels is used as the normalization result corresponding to each target level.

[0031] As described above, since the more the number of alarms for a target level, the greater the alarm weight of that target level should be, the proportion of the number of alarms for the target level is used as a factor affecting the alarm weight of the target level. On this basis, it is also considered that when the number of alarms for a target level is more, the risk of that target level should tend to increase exponentially. Therefore, the obtained weight reference value is used as another factor affecting the alarm weight of the target level, making the obtained alarm weight corresponding to the target level more reasonable.

[0032] Further, the method obtains the alarm weight corresponding to each alarm level within each target level through the following steps:

[0033] S210. For any target level, calculate the initial weight corresponding to each alarm level within the target level according to the number of alarms corresponding to each alarm level within the target level; where the initial weight corresponding to each alarm level within the target level meets the following conditions:

[0034] ζ ij =(K ij / ∑ n j＝1 K ij )+j×log(abs(K ij -K i1 ))), where ζ ij is the alarm weight corresponding to the j-th alarm level within the i-th target level, K ij is the number of alarms corresponding to the j-th alarm level within the i-th target level, K i1 to K in correspond to alarm levels that increase in sequence, n is the number of alarm levels within any target level, and abs() is the absolute value function; in this embodiment, K i1 represents the number of alarms corresponding to the information alarm level within the i-th target level, and K in represents the number of alarms corresponding to the emergency alarm level within the i-th target level.

[0035] S220, Normalize the initial weight corresponding to each alarm level within the target level to between 0 and 1 to obtain the alarm weight corresponding to each alarm level within the target level.

[0036] Preferably, the ratios of the initial weights corresponding to each alarm level within the target level to the sum of the initial weights corresponding to all alarm levels within the target level are respectively used as the normalization results corresponding to each alarm level within the target level.

[0037] As described above, the more the number of alarms corresponding to any alarm level within the target level, the greater the alarm weight of this alarm level should be. Therefore, the proportion of the number of alarms corresponding to the alarm levels within the same target level is used as a factor affecting the alarm weight of the alarm level. And when the level corresponding to the alarm level is higher, it indicates that the risk of the system is greater. Therefore, when obtaining the alarm weight of the alarm level, the weight gain brought by the difference in the number of alarms between each level and the lowest level is also introduced, making the alarm weight corresponding to each alarm level obtained more reasonable.

[0038] S300, According to the number of alarms corresponding to each alarm level within each target level and the alarm weight corresponding to each alarm level, calculate the weighted sum respectively to obtain the initial alarm index corresponding to each target level.

[0039] Specifically, the initial alarm index corresponding to the target level meets the following conditions:

[0040] Q i =∑ n j＝1 (ζ ij ×K ij ), where Q i is the initial alarm index corresponding to the i-th target level.

[0041] S400, According to the alarm weight corresponding to each target level and the initial alarm index corresponding to each target level, obtain the target alarm index corresponding to each target level to output the alarm evaluation data corresponding to the target server. In a specific implementation, the alarm evaluation data is displayed in a graphical manner in real time.

[0042] Specifically, the target alarm index corresponding to each target level meets the following conditions:

[0043] Among them, F i is the target alarm index corresponding to the i-th target level, W0 i is the alarm weight corresponding to the i-th target level, Q i is the initial alarm index corresponding to the i-th target level.

[0044] After obtaining the initial alarm index corresponding to the target level and the alarm weight corresponding to the target level, the alarm index corresponding to the target level is obtained by assigning the corresponding alarm weight to the initial alarm index, and the obtained alarm index is used as an input parameter and input into the tanh function to compress the alarm index of each obtained target level into the same reasonable range to represent the risk index of each target level, making the displayed data more reasonable and enabling users to quickly grasp the risk levels of each level.

[0045] Further, the alarm evaluation data corresponding to the target server includes the target alarm index corresponding to each target level, the overall alarm index of the target server, and the proportion of the alarm index of each alarm level within each target level.

[0046] Specifically, the overall alarm index of the target server is the maximum value among the target alarm indexes corresponding to all target levels. A schematic diagram of the overall alarm index of the target server is as Figure 2 shown, in which the target alarm index of each layer is also displayed. The target alarm indexes of the four levels are 99, 70, 99, and 84 respectively, and the overall alarm index is 99.

[0047] Further, the proportion of the alarm index of each alarm level within each target level is the proportion calculated according to the alarm weight corresponding to each target level and the alarm weight corresponding to each alarm level within each target level. The proportion of the alarm index of each alarm level within each target level is as Figure 3 shown.

[0048] Further, the proportion of the alarm index of each alarm level within each target level meets the following conditions:

[0049] S401. Calculate the proportion of the alarm index of each target level according to the alarm weight of each target level and the number of alarm times of each target level; it can be understood that when the number of alarm times of the target level is 0, since the weight is dynamically adjusted according to the number of alarm times, the alarm weight corresponding to the target level is also 0.

[0050] Specifically, the proportion of the alarm index of the target level meets the following conditions:

[0051] R i =(W0 i ×K i ) / ∑ m h＝1 (W0 h ×K h ), where R i is the proportion of the alarm index of the i-th target level, W0 h is the alarm weight corresponding to the h-th target level, and K his the number of alarms for the h-th target level.

[0052] S402. Calculate the alarm index proportion of each alarm level within each target level according to the alarm index proportion of each target level.

[0053] Specifically, the alarm index proportion of each alarm level within the target level meets the following conditions:

[0054] P ij = R i × (ζ ij × K ij ) / ∑ n d＝1 (ζ id × K id ), where P ij is the alarm index proportion of the j-th alarm level within the i-th target level, ζ id is the alarm weight corresponding to the d-th alarm level within the i-th target level, and K id is the number of alarms corresponding to the d-th alarm level within the i-th target level.

[0055] As described above, after obtaining the target alarm index corresponding to each target level, further obtain the overall alarm index of the target server, so that a numerical value can be used to represent the overall risk index of the server, and evaluate the contribution of each alarm level of each target level to the overall alarm index, enabling users to timely and comprehensively grasp the running risk status of the system.

[0056] In summary, the present invention provides a method for evaluating alarm data of a server. First, obtain the number of alarms of each target level corresponding to data processing in the target server and the number of alarms corresponding to each alarm level within each target level according to a preset time period. Then, respectively obtain the alarm weight corresponding to each target level and the alarm weight corresponding to each alarm level within each target level based on the obtained number of alarms. In this process, the number of alarms of the target level and the weight gain brought by different alarm levels are respectively introduced, making the obtained alarm weights more reasonable. Then, calculate the obtained parameters to get the initial alarm index corresponding to each target level. According to the alarm weight corresponding to each target level and the initial alarm index corresponding to each target level, obtain the target alarm index corresponding to each target level. The present invention can automatically adjust each weight parameter according to the dynamic change of the number of alarms, ensure that the system can automatically calculate reasonable alarm data, and thus more accurately and timely evaluate the security risk of the target server.

[0057] An embodiment of the present invention further provides a non-transitory computer-readable storage medium, which can be disposed in an electronic device to store at least one instruction or at least one program related to a method in the method embodiment. The at least one instruction or the at least one program is loaded and executed by the processor to implement the alarm data evaluation method of the server provided in the above embodiment.

[0058] An embodiment of the present invention further provides an electronic device, including a processor and the foregoing non-transitory computer-readable storage medium.

[0059] Although some specific embodiments of the present invention have been described in detail by way of examples, those skilled in the art should understand that the above examples are only for illustration and not for limiting the scope of the present invention. Those skilled in the art should also understand that various modifications can be made to the embodiments without departing from the scope and spirit of the present invention. The scope of the present invention is defined by the appended claims.

Claims

1. A method for evaluating alarm data of a server, characterized in that: The method comprises the following steps: Acquire the number of alarms for each target level and the number of alarms for each alarm level in each target level corresponding to data processing in the target server according to a preset time period; According to the number of alarms at each target level and the number of alarms corresponding to each alarm level within each target level, respectively obtain the alarm weight corresponding to each target level and the alarm weight corresponding to each alarm level within each target level; According to the number of alarms corresponding to each alarm level in each target level and the alarm weight corresponding to each alarm level, a weighted sum is calculated to obtain the initial alarm index corresponding to each target level; According to the alarm weight corresponding to each target level and the initial alarm index corresponding to each target level, the target alarm index corresponding to each target level is obtained to output the alarm evaluation data corresponding to the target server.

2. The method for evaluating server alarm data according to claim 1, characterized in that: The target layer refers to any one of the network layer, host layer, application layer and data layer.

3. The method for evaluating the alarm data of a server according to claim 1, characterized in that: Obtain the corresponding alarm weight for each target level through the following steps: Calculate the alarm frequency ratio of each target level, and input the alarm frequency ratio of each target level as x into the preset normalization model y=4 / (1+e -x )-2, obtain the weight reference value corresponding to each target level; The product of the alarm frequency ratio of each target level and the weight reference value corresponding to each target level is determined as the initial weight corresponding to each target level; The initial weight corresponding to each target level is normalized to between 0 and 1 to obtain the alarm weight corresponding to each target level.

4. The method for evaluating the alarm data of a server according to claim 1, characterized in that: Obtain the alarm weight corresponding to each alarm level in each target level through the following steps: For any target level, the initial weight corresponding to each alarm level in the target level is calculated according to the number of alarms corresponding to each alarm level in the target level; wherein the initial weight corresponding to each alarm level in the target level meets the following conditions: ζ ij =(K ij / ∑ n j＝1 K ij )+j×log(abs(K ij -K i1 )), where ζ ij is the alarm weight corresponding to the jth alarm level in the i-th target level, K ij is the number of alarms corresponding to the jth alarm level in the i-th target level, K i1 To K in The corresponding alarm levels increase in sequence, n is the number of alarm levels in any target level, and abs() is the absolute value function; The initial weight corresponding to each alarm level in the target level is normalized to between 0 and 1 to obtain the alarm weight corresponding to each alarm level in the target level.

5. The method for evaluating server alarm data according to claim 1, characterized in that: The target alarm index corresponding to each target level meets the following conditions: Among them, F i is the target warning index corresponding to the i-th target level, W0 i is the alarm weight corresponding to the i-th target level, Q i is the initial alarm index corresponding to the i-th target level.

6. The method for evaluating server alarm data according to claim 1, characterized in that: The alarm evaluation data corresponding to the target server includes the target alarm index corresponding to each target level, the overall alarm index of the target server and the alarm index ratio of each alarm level in each target level.

7. The method for evaluating server alarm data according to claim 6, characterized in that: The overall alarm index of the target server is the maximum value of the target alarm indexes corresponding to all target levels.

8. The method for evaluating server alarm data according to claim 6, characterized in that: The alarm index proportion of each alarm level in each target level is a proportion calculated according to the alarm weight corresponding to each target level and the alarm weight corresponding to each alarm level in each target level.

9. A non-transitory computer-readable storage medium, wherein at least one instruction or at least one program is stored in the storage medium, characterized in that: The at least one instruction or the at least one program is loaded and executed by the processor to implement the alarm data evaluation method of the server as described in any one of claims 1-8.

10. An electronic device, characterized in that: The invention comprises a processor and the non-transitory computer-readable storage medium as claimed in claim 9.

Images