Computer performance security test method and system

Abstract

The invention relates to the technical field of computer system performance and security testing, in particular to a computer performance security testing method and system. The method specifically comprises the steps that performance indexes, behavior characteristics and security event data of a target system are obtained in real time and subjected to standardization processing, clustering modeling is conducted on the behavior characteristics subjected to dimension reduction through a Gaussian mixture model so as to establish a normal behavior pattern cluster, and time sequence analysis is conducted on a behavior sequence in combination with a hidden Markov model so as to recognize a system state transition path; adopting a weighted combination strategy to mix and inject a normal load and an aggressive load, and adjusting an abnormal behavior chain through a disturbance function; constructing directed weighted association between the abnormal event and the performance index based on an event-driven causal performance diagram, quantifying a system risk index and triggering an alarm; outputting performance bottlenecks, security vulnerabilities and optimization suggestions, and updating the knowledge base to optimize subsequent models. According to the invention, deep coupling of performance and safety testing, intelligent scheduling of dynamic loads and interpretable positioning of risk paths are realized.

Description

Technical Field

[0001] The present invention relates to the technical field of computer system performance and security testing, and in particular to a computer performance security testing method and system. Background Art

[0002] With the continuous growth of computer system complexity and business load pressure, the need for synergy between performance testing and security testing has become increasingly prominent. Traditional testing methods usually implement performance testing (such as load pressure assessment and resource bottleneck analysis) and security testing (such as vulnerability scanning and intrusion detection) independently, resulting in fragmented test data and insufficient scenario authenticity. It is difficult to capture the risk of security vulnerabilities under high concurrent loads (such as permission check failure caused by resource exhaustion) or hidden attack paths induced by performance bottlenecks (such as privilege escalation vulnerabilities caused by memory leaks).

[0003] The Chinese invention patent application with publication number CN116614277A discloses a network security supervision system and method based on machine learning and abnormal behavior analysis, including: a security supervision front-end system for performing data collection on security operation and maintenance management objects, and through it, performing operation and maintenance management and control of management objects, and issuing equipment policies; a security analysis and judgment center for adopting a big data analysis and computing platform architecture, through the extraction, analysis, and cleaning of historical and real-time network operation and maintenance data and security monitoring data, and using event correlation analysis to provide data support services for upper-level business applications; a security monitoring and control center for performing operation monitoring and resource monitoring of network resources and security resources based on the analysis results of the security analysis and judgment center; and evaluating the overall situation, threat situation, risk management, business health, asset situation and protection situation of the entire network, thereby enhancing the security situation awareness and comprehensive control capabilities of the network operation status.

[0004] In the existing technical system, performance testing usually focuses on the evaluation of indicators such as resource utilization and response delay, while security testing mostly performs static scanning for known vulnerabilities. The two types of tests lack deep integration in data collection, scenario simulation and analysis dimensions, making it difficult to truly restore the actual operating environment of high-concurrency business flows and complex attack chains. In addition, the load generation method based on fixed scripts cannot dynamically adapt to changes in system status, and the single-dimensional behavior analysis model has limited ability to capture spatiotemporal correlation characteristics, resulting in test results that are difficult to accurately locate the causal link between performance degradation and security vulnerabilities. To address the above problems, there is an urgent need to build an integrated testing framework that integrates dynamic load injection, multi-dimensional behavior modeling and risk correlation analysis. Through intelligent scenario simulation and data-driven decision-making mechanisms, the system's comprehensive evaluation capabilities under extreme load and mixed attack scenarios can be achieved, providing technical support for the stability optimization and security assurance of modern computer systems. Summary of the Invention

[0005] The purpose of the present invention is to address the problems existing in the background technology and to propose a computer performance security testing method and system.

[0006] The technical solution of the present invention is a computer performance security testing method, comprising the following implementation steps:

[0007] S1. Collect performance data, behavior data, and security event data of the computer system under test, and perform Z-score standardization on the collected data;

[0008] S2. Build a multidimensional behavioral baseline model for the testing phase. Use sliding windows and principal component analysis to reduce dimensions and construct behavioral features. Use Gaussian mixture model clustering to establish normal behavior pattern clusters. Combined with hidden Markov models, analyze temporal state transitions, detect anomalies, and predict system degradation and attack paths.

[0009] S3. Generate simulation paths by constructing scenario behavior vectors and state mapping matrices, adopt a weighted combined load scheduling strategy to dynamically control load intensity and timing, build abnormal behavior chains and introduce perturbation functions, and adjust test strategies in real time using a feedback regulation mechanism.

[0010] S4. By collecting multi-dimensional performance indicators and abnormal event sequences after load injection, an event-driven causal performance graph model is constructed. This model defines a directed weighted association between abnormal event nodes and performance indicator nodes, quantifies the impact of abnormal behavior on performance, calculates the system risk index, and triggers dynamic alarms.

[0011] S5. Output performance bottlenecks, security vulnerabilities, risk scores and recommendation reports, and archive test data.

[0012] Preferably, the process of constructing the multidimensional behavioral baseline model for the testing phase is as follows:

[0013] S21. Divide the data into a sliding window mechanism to form a time series feature sequence F t =[x'1(t),x'2(t),...,x' i (t),...,x' n (t)], principal component analysis is used to reduce the dimension and obtain the low-dimensional behavior expression, that is, the system behavior feature vector:

[0014] Among them, x' i (t) represents the standard data of the i-th data point at time t; F t represents the standardized behavioral feature vector constructed on the time window t; n represents the dimension of the standardized features of the original collection; T represents the length of the time window; represents the d-dimensional real space; d represents the dimension after dimensionality reduction; φ(·) represents the principal component analysis method; Zt represents the behavioral characteristics at time t;

[0015] S22. Construct feature samples Define the Gaussian mixture model, where the behavior vector obeys a weighted combination of multivariate Gaussian distributions: The feature sample Clustering into k clusters;

[0016] Where k represents the number of clusters of behavior patterns; π i Represents the weight of the i-th Gaussian component, satisfying μ' i represents the center of the i-th behavior cluster; i represents the covariance matrix of the i-th behavior cluster; Represents the multidimensional Gaussian distribution density function; P(Z t ) represents a weighted combination;

[0017] And get the real-time behavior vector Z new , after being processed by the clustering model, if the real-time behavior vector Z new The Mahalanobis distance D i (Z new )>δ, judged as abnormal behavior;

[0018]

[0019] Among them, δ is the behavior deviation threshold;

[0020] S23. Use the hidden Markov model to perform time series modeling on the clustered behavior sequence, define the mapping relationship between state transition and observation probability, use the Baum-Welch algorithm to train the model parameters, use the Viterbi algorithm to predict the future state path of the system, and analyze the transition matrix to identify abnormal frequency increases and new states.

[0021] Preferably, the process of performing time series modeling on the clustered behavior sequence through the hidden Markov model is as follows:

[0022] S31, obtain the behavior sequence of cluster modeling: S = {s1, s2, ..., s t ,...,s T},s t ∈{1,2,...,k};

[0023] Where T represents the time window length; s t Indicates the cluster number corresponding to the t-th moment;

[0024] S32. Use a hidden Markov model to establish a probability mapping relationship between state transitions and observations, and define the HMM model quintuple λ = (A, B, π', Q, O);

[0025] Where Q={q1,...,q j ,...,q N} represents the implicit behavior state q j Set; O = {o1,...,o i ,...,o k} represents the observable behavior cluster label; o i represents the i-th behavior cluster label; π' represents the initial state probability vector, A={a ij} represents the state transition matrix, that is, the probability of transitioning from state i to state j; B = {b j (o i )} represents the observation probability matrix, that is, in state q j Observed below o i probability;

[0026] S33, perform state path inference on a given observation sequence S using the Viterbi algorithm: Q * =argmaxP(Q|S,λ), predicting the state the system will enter in the next m steps;

[0027] Among them, Q * Indicates the most likely state path;

[0028] S34. Identify potential problems by analyzing the transition probability matrix A.

[0029] Preferably, the process of constructing the scene behavior vector and the state mapping matrix to generate the simulation path is as follows:

[0030] S41. Based on the multi-dimensional behavior clustering results and abnormal sequence status, construct the scene behavior vector: S i ={F i1 ,F i2 ,...,F ij ,...,F in}, use the state mapping matrix to build the simulation path: M:S i →{Es j ,A k};

[0031] Among them, S i represents the behavior state vector of the i-th simulation scenario; F ij represents the state value of behavior dimension j; n represents the number of behavior dimensions; Es j Indicates the desired system load event; A k Represents an abnormal behavior injection event; M: represents the mapping function from behavior state to injection event;

[0032] S42, through on-demand combination + weight drive + timing control, adopt weighted combination load scheduling strategy to dynamically adjust simulation intensity and behavior path:

[0033] Where, L(t) represents the comprehensive load at time t; f i (t) represents the load function of the i-th type (including but not limited to CPU calculation, IO writing, network request); ω i represents the weight of the i-th load type (depending on the importance of the behavior in the scenario); N represents the total number of load types;

[0034] S43, by defining an abnormal behavior chain including attack operations and waiting time, introducing a perturbation function to insert a null operation, adjust the order, or set a mask instruction, thereby generating an abnormal behavior chain;

[0035] S44, inject the constructed load flow and abnormal behavior chain into the target system, collect the system response status in real time, build a feedback adjustment mechanism, and build a state evaluation and strategy adjustment function Feedback(t)=h(St t ,L(t),R(t));

[0036] Among them, St t represents the system state at time t; L(t) represents the load pressure at time t; R(t) represents the system response; h(·) represents the strategy function.

[0037] Preferably, the abnormal behavior chain generation process is as follows:

[0038] S51. Define an abnormal behavior chain C:

[0039] Among them, C represents the abnormal behavior chain; a i represents the i-th attack operation; τi represents the waiting time between operations;

[0040] S52. Introduce the perturbation function: C'=C+ε(t);

[0041] Where ε(t) represents the disturbance term; C' represents the abnormal behavior chain after the disturbance term is introduced.

[0042] Preferably, the process of building the event-driven causal performance graph model is as follows:

[0043] S61. Based on each round of load and abnormal injection process, collect the multi-dimensional performance response index P of the system at time t t , and uses a sliding window for normalization and smoothing to form a set of performance indicator time series based on time alignment;

[0044] S62. Collect the injection time and event sequence of the abnormal behavior chain: ε={(ti ,e i ,c i )};

[0045] Among them, e i represents the label of the i-th abnormal event; t i Indicates the corresponding timestamp; c i Contextual information representing abnormal events;

[0046] S63. Define an event-driven causal performance graph and define a directed weighted association between abnormal event nodes and performance indicator nodes. Use the observation window to calculate the response intensity of abnormal behavior to performance indicators. Filter significant impact edges based on the threshold and generate a weight matrix. Output the event-driven causal performance graph.

[0047] Preferably, the process of generating the event-driven causal performance graph is as follows:

[0048] S71. Define a directed graph model G = (V, E);

[0049] Among them, the node set V: V = V e ∪V p , by the abnormal event node V e With performance index node V p Composition; E represents a directed edge set;

[0050] S72. Establish a directed edge set E and relationship weights. Each edge, that is, e i →p k , indicating abnormal behavior e i For performance index p k Direct impact path;

[0051] Assign weight ζ to each edge ik :

[0052] Among them, ik Indicates abnormal behavior i For performance index p k The impact intensity of t i Indicates abnormal behavior i The time point of injection; τ represents the length of the observation window; p k (t i +τ) represents the performance data after abnormal injection; p k (t i ) represents the instantaneous performance data before injection;

[0053] S73, if ik >θ k , then it is considered that abnormal behavior has a negative impact on the performance index p k It has a significant impact and the edge is retained in the graph;

[0054] Among them, θ k Indicates the set indicator dimension threshold;

[0055] S74. Output graph G = (V, E, W);

[0056] Where V represents the node set; E represents the directed edge set; W = {ζ ik} represents the weight matrix of each edge.

[0057] Preferably, the calculation process of the system risk index is:

[0058] If Risk t >Θ, a risk alert is issued and dynamic protection is triggered immediately;

[0059] Among them, ω ij Indicates event e i The weight of Risk t represents the system risk value at the current moment; Θ represents the upper limit of system risk.

[0060] The technical solution of the present invention is a computer performance security testing system, which is used to execute the above-mentioned computer performance security testing method, and is characterized by comprising:

[0061] Data collection module, used to collect resource usage data during system runtime and simultaneously collect system behavior monitoring data;

[0062] Multidimensional behavior analysis module, which is used to model system behavior patterns using clustering + time series models and establish multidimensional behavior baselines under normal and abnormal conditions;

[0063] Dynamic load injection module, used to inject different types of loads into the target system through the user behavior simulator, simulating mixed injection of attack loads;

[0064] Performance-safety correlation analysis module, used to evaluate performance and safety indicators in real time and call risk functions;

[0065] The test report generation module is used to output reports and update the knowledge base, and automatically mark potential security risks that occur under high load / high concurrency.

[0066] Compared with the prior art, the above technical solution of the present invention has the following beneficial technical effects:

[0067] This paper designs a computer performance security testing method and system. By integrating the Gaussian mixture model (GMM) and the hidden Markov model (HMM), this method achieves collaborative modeling of the spatial clustering and temporal evolution of system behavior, significantly improving the comprehensiveness and accuracy of anomaly detection and effectively reducing the false alarm rate. A weighted combination strategy is used to inject a mixture of normal and attack loads, combined with a perturbation function to generate diverse abnormal behavior chains. This breaks through the static scenario limitations of traditional testing tools, can simulate the coupling effects of performance and security threats in real environments, and trigger complex vulnerabilities that are difficult to cover with traditional methods. A directed weighted association model is constructed based on an event-driven causal performance graph (ECPG) to quantify the causal impact of abnormal events on performance indicators, accurately locate risk paths, and provide interpretable analysis results, providing data-driven decision support for system optimization. The self-evolution mechanism of the knowledge base continuously improves the system's detection capability and adaptability to unknown attack patterns by archiving test data and risk paths and retraining model parameters, forming a closed-loop optimization process. The overall solution significantly improves testing efficiency, scenario coverage depth, and risk warning capabilities, providing an innovative solution for the integrated performance and security assessment of complex computer systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] Figure 1 This is a system architecture diagram of a computer performance security testing system proposed by the present invention;

[0069] Figure 2 This is a flow chart of a computer performance security testing method proposed by the present invention. DETAILED DESCRIPTION

[0070] Example 1, as Figure 1 As shown, a computer performance security testing system proposed in the present invention includes: a data acquisition module, a multi-dimensional behavior analysis module, a dynamic load injection module, a performance-security correlation analysis module, and a test report generation module.

[0071] Data collection module, which collects system runtime resource usage data (including but not limited to CPU, memory, I / O, and network), and simultaneously collects system behavior monitoring data (including but not limited to process behavior, system calls, abnormal event logs, and security alarm data);

[0072] Multidimensional behavior analysis module, which uses clustering + time series model to model system behavior patterns and establish multidimensional behavior baselines under normal and abnormal conditions;

[0073] Dynamic load injection module, which injects different types of loads into the target system through user behavior simulators (including but not limited to virtual users and interface simulators), simulating mixed injection of attack loads (including but not limited to denial of service, abnormal authorized access, etc.);

[0074] Performance-safety correlation analysis module, which evaluates performance and safety indicators in real time and calls risk functions;

[0075] The test report generation module outputs reports and updates the knowledge base, and automatically marks potential security risks that occur under high load / high concurrency.

[0076] Example 2, as Figure 2 As shown, a computer performance security testing method proposed in the present invention is applied to a computer performance security testing system proposed in Example 1, and its specific implementation steps are as follows:

[0077] S1. Load the environment information, test targets, and parameter configurations of the computer device under test according to the preset test strategy, including but not limited to the resource specifications, interface calling methods, security boundary strategies, and fault-tolerant configuration rules of the target system;

[0078] When the target system is in baseline operation, activate the data acquisition module to continuously collect the following:

[0079] Performance indicators: including but not limited to CPU load, memory usage, disk IO, and network latency;

[0080] Behavioral features: including but not limited to process call chains, system call logs, and abnormal event triggering;

[0081] Security events: including but not limited to login status changes, port opening, and access control anomalies;

[0082] For each class of original data x i (t) Perform Z-score normalization at each time slice t:

[0083]

[0084] Among them, x i (t) represents the i-th original data point; μ i Represents the original data x i (t) Historical average value of data type; σ i Represents the original data x i (t) Historical standard deviation of data type; x' i (t) Normalized data showing historical standard deviation;

[0085] The standardized data were transferred to the multidimensional behavior analysis module.

[0086] S2. The multi-dimensional behavior analysis module builds a multi-dimensional behavior baseline model for the testing phase based on performance, behavior, and security log data. The specific implementation process is as follows:

[0087] S21. Behavioral feature construction and dimensionality reduction: integrating multidimensional data vectors into a unified behavioral representation, performing dimensionality reduction, and extracting high-value features:

[0088] S2101. Divide the data into a sliding window mechanism to form a time series feature sequence F t =[x'1(t),x'2(t),...,x' n (t)];

[0089] Among them, F t represents the standardized behavioral feature vector constructed on the time window t; n represents the dimension of the standardized features of the original collection; T represents the length of the time window;

[0090] S2102. Use principal component analysis (PCA) to perform dimensionality reduction and obtain low-dimensional behavior expression:

[0091] in, represents the d-dimensional real space, that is, the set of all vectors consisting of d real numbers; d represents the dimension after dimensionality reduction; φ(·) represents the PCA method; Z t represents the behavioral characteristics at time t;

[0092] S22. Multidimensional behavioral pattern clustering modeling: This involves performing unsupervised learning modeling on the system's behavioral feature vectors after dimensionality reduction. Clustering algorithms are used to identify and classify the system's operating states at different time slices, establishing "normal behavior pattern clusters." When new behavioral features break away from these clusters, they can be quickly identified as potential abnormal states or attack operations. Specifically:

[0093] S2201, construct feature samples

[0094] S2202. Define a Gaussian mixture model (GMM), where the behavior vector obeys a weighted combination of multivariate Gaussian distributions:

[0095] Where k represents the number of clusters of behavior patterns; π i Represents the weight of the i-th Gaussian component, satisfying μ' i represents the center of the i-th behavior cluster; i represents the covariance matrix of the i-th behavior cluster, describing the discrete degree of the behavior; Represents the multidimensional Gaussian distribution density function; P(Z t ) represents a weighted combination;

[0096] It should be noted that the model is trained by the expectation maximization algorithm (EM) to obtain: cluster center μ' i , covariance matrix E i , weight π i ;

[0097] Based on this: the feature sample Clustering into k clusters, each cluster represents a "typical behavior pattern of the system";

[0098] S2203, obtain real-time behavior vector Z new After being processed by the clustering model, the Mahalanobis distance with the center of each cluster is calculated to determine its category or whether it is an abnormal outlier:

[0099]

[0100] If the following conditions are met, it is judged as "abnormal behavior": real-time behavior vector Z new The Mahalanobis distance D i (Z new )>δ, where δ is the behavioral deviation threshold;

[0101] S23. Use time series modeling methods to model the clustered behavioral pattern sequences, explore the patterns of system behavior changes over time, identify potential system degradation trends, hidden attack paths, or abnormal state transition probabilities, and further enhance the depth and breadth of system performance security testing. Specifically:

[0102] S2301, obtain the behavior sequence of cluster modeling: S={s1,s2,...,s t ,...,s T},s t ∈{1,2,...,k};

[0103] Where T represents the time window length; s t Indicates the cluster number corresponding to the t-th moment, that is, the system is in a certain "behavioral state";

[0104] S2302. Use a hidden Markov model (HMM) to establish a probability mapping relationship between state transitions and observations, and define the HMM model quintuple λ = (A, B, π', Q, O);

[0105] Where Q={q1,...,q j ,...,q N} represents the implicit behavior state q j Set (including but not limited to "normal operation", "degradation", "high risk"); O = {o1,...,o i ,...,o k} represents the observable behavior cluster label (output by GMM); o i represents the i-th behavior cluster label; π' represents the initial state probability vector, that is, the probability of the system being in each hidden state at the beginning; A={a ij} represents the state transfer matrix, that is, the transition probability between hidden states, that is, the probability of transferring from state i to state j; B = {b j (o i )} represents the observation probability matrix, that is, in state q j Observed below o i The probability that the hidden state j generates the observation o i probability;

[0106] It should be noted that the Baum-Welch algorithm (EM iteration) is used to perform unsupervised learning on the model. The training goal is to maximize the likelihood estimate P(O|λ) of the system behavior state sequence, and finally output the state transition probability matrix A, the observation probability matrix B, and the state initial distribution π;

[0107] S2303, using the Viterbi algorithm (Viterbi) to infer the most likely state path for a given observation sequence S: Q * =argmaxP(Q|S,λ), predicting the state the system will enter in the next m steps (including but not limited to abnormal risk state);

[0108] Among them, Q * Indicates the most likely state path;

[0109] Based on this: By analyzing the transition probability matrix A, the following potential problems are identified: increased frequency of abnormal transitions, emergence of new states, and increased state jumping.

[0110] S3, the dynamic load injection module, builds highly realistic and controllable test scenarios through intelligent scheduling of simulated traffic, environmental state disturbances, and behavioral link reproduction, integrating performance testing and security testing. The specific implementation process is as follows:

[0111] S31, constructing a scene behavior vector based on the multi-dimensional behavior clustering result and abnormal sequence state output in step S3: S i ={F i1 ,F i2 ,...,F ij ,...,F in};

[0112] Among them, S i represents the behavior state vector of the i-th simulation scenario; F ij represents the state value of behavior dimension j; n represents the number of behavior dimensions (including but not limited to CPU usage, disk IO, and call chain depth);

[0113] Constructing simulation paths using the state mapping matrix: M:S i →{Es j ,A k};

[0114] Among them, Es j Indicates the required system load events (including but not limited to high-concurrency HTTP and memory overflow simulation); A k Represents abnormal behavior injection events (including but not limited to simulated SQL injection and malicious process creation); M: represents the mapping function from behavior state to injection event, which is jointly trained and generated by expert knowledge and historical pattern mining;

[0115] S32. Use control functions to schedule different load types and intensities. That is, through on-demand combination + weight drive + timing control, a weighted combination load scheduling strategy is adopted to dynamically adjust the simulation intensity and behavior path:

[0116] Where, L(t) represents the comprehensive load at time t; f i (t) represents the load function of the i-th type (including but not limited to CPU calculation, IO writing, network request); ω i represents the weight of the i-th load type (depending on the importance of the behavior in the scenario); N represents the total number of load types;

[0117] For example, f i (t) represents the load function of type i: f1(t): CPU cycle calculation; f2(t): high concurrency of disk read and write; f3(t): IO delay simulation; f4(t): memory heap expansion; f5(t): RPC or REST call simulation;

[0118] It should be noted that the weight setting strategy is: Where Imp(f i ) represents the importance score derived from the proportion and activity of various resources in the behavior sequence of step S3;

[0119] S33. Based on the abnormal evolution path in the behavior model (including but not limited to the Kill Chain), a dynamic behavior injection chain is constructed. Specifically:

[0120] S3301. Define an abnormal behavior chain C:

[0121] Among them, C represents the abnormal behavior chain; a i represents the i-th attack operation (including but not limited to script creation, remote download, and execution privilege escalation); τi represents the waiting time between operations, simulating the real attack rhythm;

[0122] S3302. Introduce a perturbation function to enhance the diversity and recurrence rate of abnormal chains: C'=C+ε(t);

[0123] Where ε(t) represents the disturbance term (including but not limited to inserting no-operations, adjusting the order, and setting mask instructions); C' represents the abnormal behavior chain after the introduction of the disturbance term;

[0124] S34, inject the constructed load flow + exception chain into the target system, collect the system response status in real time, build a feedback adjustment mechanism, and build a state evaluation and strategy adjustment function Feedback(t)=h(St t ,L(t),R(t));

[0125] Among them, St t represents the system state at time t; L(t) represents the load pressure at time t; R(t) represents the system response (including but not limited to response time, number of abnormal alarms, and memory fluctuation); h(·) represents the policy function;

[0126] It should be noted that the policy function h(·) controls whether to: increase the load, switch scenarios, terminate the test, or mark performance bottlenecks based on the feedback results.

[0127] S4, the performance-security correlation analysis module, is based on the dynamic injection results of step S3 and aims to build a coupling correlation model between performance indicators and security events, providing decision support for bottleneck identification and risk assessment in complex test environments. The specific implementation process is as follows:

[0128] S41. Based on each round of load / abnormal injection process, collect the multi-dimensional performance response index P of the system at time t t including but not limited to CPU usage Memory usage Disk IO throughput Network sending and receiving speed Response Delay Number of abnormal alarms A sliding window is used for normalization and smoothing to form a set of performance indicator time series based on time alignment;

[0129] S42, collect the injection time and event sequence of the behavior chain: ε={(t i ,e i ,c i )};

[0130] Among them, e i Indicates the label of the ith abnormal event (including but not limited to abnormal login, abnormal system call, command injection); t i Indicates the corresponding timestamp; c iContext information indicating the abnormal event, including but not limited to thread ID, process call stack, and user identifier;

[0131] S43. We propose an event-driven causal performance graph (ECPG), which uses the system's performance response as the effect variable and the injected anomaly as the cause variable. We construct a directed weighted graph to implement refined risk path reasoning. Specifically:

[0132] S4301. Construct a directed graph model G = (V, E);

[0133] Among them, the node set V: V = V e ∪V p , by the abnormal event node V e With performance index node V p Composition; E represents a directed edge set;

[0134] It should be noted that the abnormal event node V e : Each node represents an anomaly type, including but not limited to SQL injection e1, remote command execution e2, denial of service attack e3, high-frequency IO access e4, illegal access e5, and privilege escalation attempt e6;

[0135] Performance Index Node V p : That is, including but not limited to CPU usage Memory usage Disk IO throughput Network sending and receiving speed Response Delay Number of abnormal alarms

[0136] S4302. Establish a directed edge set E and relationship weights. Each edge (e i →p k ) means "abnormal behavior i "To" performance index p k "The direct impact path, giving each edge a weight ζ ik , indicating the response strength:

[0137] Among them, ik Indicates abnormality i For performance index p k The impact intensity of t i Indicates the timestamp, that is, the exception e i The time point of injection; τ represents the length of the observation window; p k (t i +τ) represents the performance data after abnormal injection; p k(t i ) represents the instantaneous performance data before injection;

[0138] If ik >θ k (Indicator dimension threshold), it is considered that the abnormal behavior has a significant impact on the performance indicator, and the edge is retained in the graph;

[0139] S4303, output graph G = (V, E, W);

[0140] Where V represents the node set (events and performance); E represents the directed edge set; W = {ζ ik} represents the weight matrix of each edge;

[0141] S44. Based on the established causal graph, construct the overall system risk index:

[0142] Among them, ω ij Indicates event e i The weight of Risk is set according to its severity level; t Indicates the system risk value at the current moment, reflecting the performance-security coupling threat intensity of the system under the current test scenario;

[0143] S45, set the upper limit of system risk Θ, if Risk t >Θ, a risk alert is issued and dynamic protection is triggered immediately.

[0144] S5. The test report generation module archives and outputs the analysis results, including:

[0145] Performance evaluation report (bottleneck points, limit points, resource usage trends);

[0146] Security vulnerability reports (abnormal call paths, security policy failure locations);

[0147] Risk scoring and recommendations (including but not limited to system structure optimization recommendations and security policy enhancement recommendations);

[0148] The data features, risk discoveries, and system response behaviors generated by this round of testing are archived into the built-in knowledge base for use in model optimization and risk factor retraining in subsequent testing tasks, thereby enhancing the intelligent adaptive capabilities of the testing system.

[0149] The embodiments of the present invention are described in detail above with reference to the accompanying drawings, but the present invention is not limited thereto. Various changes can be made within the scope of knowledge possessed by those skilled in the art without departing from the spirit of the present invention.

Claims

1. A computer performance security testing method, characterized in that: The implementation steps include: S1. Collect performance data, behavior data, and security event data of the computer system under test, and perform Z-score standardization on the collected data; S2. Build a multidimensional behavioral baseline model for the testing phase. Use sliding windows and principal component analysis to reduce dimensions and construct behavioral features. Use Gaussian mixture model clustering to establish normal behavior pattern clusters. Combined with hidden Markov models, analyze temporal state transitions, detect anomalies, and predict system degradation and attack paths. S3. Generate simulation paths by constructing scenario behavior vectors and state mapping matrices, adopt a weighted combined load scheduling strategy to dynamically control load intensity and timing, build abnormal behavior chains and introduce perturbation functions, and adjust test strategies in real time using a feedback regulation mechanism. S4. By collecting multi-dimensional performance indicators and abnormal event sequences after load injection, an event-driven causal performance graph model is constructed. This model defines a directed weighted association between abnormal event nodes and performance indicator nodes, quantifies the impact of abnormal behavior on performance, calculates the system risk index, and triggers dynamic alarms. S5. Output performance bottlenecks, security vulnerabilities, risk scores and recommendation reports, and archive test data.

2. A computer performance security testing method according to claim 1, characterized in that: The process of constructing the multidimensional behavioral baseline model for the testing phase is as follows: S21. Divide the data into a sliding window mechanism to form a time series feature sequence F t =[x1'(t),x'2(t),...,x i '(t),...,x' n (t)], principal component analysis is used to reduce the dimension and obtain the low-dimensional behavior expression, that is, the system behavior feature vector: Among them, x i '(t) represents the standard data of the i-th data point at time t; F t represents the standardized behavioral feature vector constructed on the time window t; n represents the dimension of the standardized features of the original collection; T represents the length of the time window; represents the d-dimensional real space; d represents the dimension after dimensionality reduction; φ(·) represents the principal component analysis method; Z t represents the behavioral characteristics at time t; S22. Construct feature samples Define the Gaussian mixture model, where the behavior vector obeys a weighted combination of multivariate Gaussian distributions: The feature sample Clustering into k clusters; Where k represents the number of clusters of behavior patterns; π i Represents the weight of the i-th Gaussian component, satisfying μ i ' represents the center of the i-th behavior cluster; i represents the covariance matrix of the i-th behavior cluster; Represents the multidimensional Gaussian distribution density function; P(Z t ) represents a weighted combination; And get the real-time behavior vector Z new , after being processed by the clustering model, if the real-time behavior vector Z new The Mahalanobis distance D i (Z new )>δ, it is judged as abnormal behavior: Among them, δ is the behavior deviation threshold; S23. Use the hidden Markov model to perform time series modeling on the clustered behavior sequence, define the mapping relationship between state transition and observation probability, use the Baum-Welch algorithm to train the model parameters, use the Viterbi algorithm to predict the future state path of the system, and analyze the transition matrix to identify abnormal frequency increases and new states.

3. A computer performance security testing method according to claim 2, characterized in that: The process of temporal modeling of the clustered behavior sequence through the hidden Markov model is as follows: S31, obtain the behavior sequence of cluster modeling: S = {s1, s2, ..., s t ,...,s T },s t ∈{1,2,...,k}; Where T represents the time window length; s t Indicates the cluster number corresponding to the t-th moment; S32. Use a hidden Markov model to establish a probability mapping relationship between state transitions and observations, and define the HMM model quintuple λ = (A, B, π', Q, O); Where Q = {q1,...,q j ,...,q N } represents the implicit behavior state q j Set; O = {o1,...,o i ,...,o k } represents the observable behavior cluster label; o i represents the i-th behavior cluster label; π' represents the initial state probability vector, A={a ij } represents the state transition matrix, that is, the probability of transitioning from state i to state j; B = {b j (o i )} represents the observation probability matrix, that is, in state q j Observed below o i probability; S33, perform state path inference on a given observation sequence S using the Viterbi algorithm: Q * =argmaxP(Q|S,λ), predicting the state the system will enter in the next m steps; Among them, Q * Indicates the most likely state path; S34. Identify potential problems by analyzing the transition probability matrix A.

4. A computer performance security testing method according to claim 3, characterized in that: The process of constructing the scenario behavior vector and the state mapping matrix to generate the simulation path is as follows: S41. Based on the multi-dimensional behavior clustering results and abnormal sequence status, construct the scene behavior vector: S i ={F i1 ,F i2 ,...,F ij ,...,F in }, use the state mapping matrix to build the simulation path: M:S i →{Es j ,A k }; Among them, S i represents the behavior state vector of the i-th simulation scenario; F ij represents the state value of behavior dimension j; n represents the number of behavior dimensions; Es j Indicates the desired system load event; A k Represents an abnormal behavior injection event; M: represents the mapping function from behavior state to injection event; S42, through on-demand combination + weight drive + timing control, adopts weighted combination load scheduling strategy to dynamically adjust simulation intensity and behavior path: Where, L(t) represents the comprehensive load at time t; f i (t) represents the load function of the i-th type (including but not limited to CPU calculation, IO writing, network request); ω i represents the weight of the i-th load type (depending on the importance of the behavior in the scenario); N represents the total number of load types; S43, by defining an abnormal behavior chain including attack operations and waiting time, introducing a perturbation function to insert a null operation, adjust the order, or set a mask instruction, thereby generating an abnormal behavior chain; S44, inject the constructed load flow and abnormal behavior chain into the target system, collect the system response status in real time, build a feedback adjustment mechanism, and build a state evaluation and strategy adjustment function Feedback(t)=h(St t ,L(t),R(t)); Among them, St t represents the system state at time t; L(t) represents the load pressure at time t; R(t) represents the system response; h(·) represents the strategy function.

5. A computer performance security testing method according to claim 4, characterized in that: The abnormal behavior chain generation process is as follows: S51. Define an abnormal behavior chain C: Among them, C represents the abnormal behavior chain; a i represents the i-th attack operation; τi represents the waiting time between operations; S52. Introduce the perturbation function: C'=C+ε(t); Where ε(t) represents the disturbance term; C' represents the abnormal behavior chain after the disturbance term is introduced.

6. A computer performance security testing method according to claim 1, characterized in that: The process of building an event-driven causal performance graph model is as follows: S61. Based on each round of load and abnormal injection process, collect the multi-dimensional performance response index P of the system at time t t , and uses a sliding window for normalization and smoothing to form a set of performance indicator time series based on time alignment; S62. Collect the injection time and event sequence of the abnormal behavior chain: ε={(t i ,e i ,c i )}; Among them, e i represents the label of the i-th abnormal event; t i Indicates the corresponding timestamp; c i Contextual information representing abnormal events; S63. Define an event-driven causal performance graph and define a directed weighted association between abnormal event nodes and performance indicator nodes. Use the observation window to calculate the response intensity of abnormal behavior to performance indicators. Filter significant impact edges based on the threshold and generate a weight matrix. Output the event-driven causal performance graph.

7. A computer performance security testing method according to claim 6, characterized in that: The generation process of event-driven causal performance graph is as follows: S71. Define a directed graph model G = (V, E); Among them, the node set V: V = V e ∪V p , by the abnormal event node V e With performance index node V p Composition; E represents a set of directed edges; S72. Establish a directed edge set E and relationship weights. Each edge, that is, e i →p k , indicating abnormal behavior e i For performance index p k Direct impact path; Assign weight ζ to each edge ik : Among them, ik Indicates abnormal behavior i For performance index p k The impact intensity of t i Indicates abnormal behavior i The time point of injection; τ represents the length of the observation window; p k (t i +τ) represents the performance data after abnormal injection; p k (t i ) represents the instantaneous performance data before injection; S73, if ik >θ k , then it is considered that abnormal behavior has a negative impact on the performance index p k It has a significant impact and the edge is retained in the graph; Among them, θ k Indicates the set indicator dimension threshold; S74. Output graph G = (V, E, W); Where V represents the node set; E represents the directed edge set; W = {ζ ik } represents the weight matrix of each edge.

8. A computer performance security testing method according to claim 7, characterized in that: The calculation process of the system risk index is: If Risk t >Θ, a risk alert is issued and dynamic protection is triggered immediately; Among them, ω ij Indicates event e i The weight of Risk t represents the system risk value at the current moment; Θ represents the upper limit of system risk.

9. A computer performance security testing system, used to execute a computer performance security testing method according to any one of claims 1 to 8, characterized in that: include: Data collection module, used to collect resource usage data during system runtime and simultaneously collect system behavior monitoring data; Multidimensional behavior analysis module, which is used to model system behavior patterns using clustering + time series models and establish multidimensional behavior baselines under normal and abnormal conditions; Dynamic load injection module, used to inject different types of loads into the target system through the user behavior simulator, simulating mixed injection of attack loads; Performance-safety correlation analysis module, used to evaluate performance and safety indicators in real time and call risk functions; The test report generation module is used to output reports and update the knowledge base, and automatically mark potential security risks that occur under high load / high concurrency.

Images