A computer performance security testing method and system

Abstract

This invention relates to the field of computer system performance and security testing technology, specifically a computer performance and security testing method and system. Specifically, it involves: acquiring and standardizing performance indicators, behavioral characteristics, and security event data of the target system in real time; using a Gaussian mixture model to cluster the dimensionality-reduced behavioral characteristics to establish normal behavior pattern clusters; combining a Hidden Markov Model to perform time-series analysis of the behavioral sequences to identify system state transition paths; employing a weighted combination strategy to inject normal and attack-type loads, and adjusting abnormal behavior chains through a perturbation function; constructing a directed weighted association between abnormal events and performance indicators based on an event-driven causal performance graph, quantifying the system risk index, and triggering alarms; outputting performance bottlenecks, security vulnerabilities, and optimization suggestions, and updating the knowledge base to optimize subsequent models. This invention achieves deep coupling of performance and security testing, intelligent scheduling of dynamic loads, and interpretable location of risk paths.

Description

Technical Field

[0001] This invention relates to the field of computer system performance and security testing technology, specifically to a computer performance and security testing method and system. Background Technology

[0002] With the continuous increase in the complexity of computer systems and the pressure of business load, the need for collaboration between performance testing and security testing is becoming increasingly prominent. Traditional testing methods usually implement performance testing (such as load stress assessment and resource bottleneck analysis) and security testing (such as vulnerability scanning and intrusion detection) independently, resulting in fragmented test data, insufficient scenario realism, and difficulty in capturing the risk of security vulnerability exposure under high concurrency load (such as permission verification failure caused by resource exhaustion) or the hidden attack paths induced by performance bottlenecks (such as privilege escalation vulnerabilities caused by memory leaks).

[0003] Chinese invention patent application CN116614277A discloses a network security supervision system and method based on machine learning and abnormal behavior analysis, including: a security supervision front-end system for collecting data on security operation and maintenance management objects, and for performing operation and maintenance control and device policy distribution operations on the managed objects; a security analysis and judgment center for using a big data analysis and computing platform architecture to extract, analyze, and clean historical and real-time network operation and maintenance data and security monitoring data, and to provide data support services for upper-layer business applications through event correlation analysis; and a security monitoring and control center for monitoring network resources and security resources based on the analysis results of the security analysis and judgment center; and for assessing the overall network situation, threat situation, risk management, business health, asset situation, and protection situation, thereby enhancing the security situation awareness and comprehensive control capabilities of network operation.

[0004] In existing technology systems, performance testing typically focuses on evaluating metrics such as resource utilization and response latency, while security testing often involves static scanning of known vulnerabilities. These two types of testing lack deep integration in data collection, scenario simulation, and analysis, making it difficult to realistically recreate the actual operating environment of high-concurrency business flows and complex attack chains. Furthermore, load generation methods based on fixed scripts cannot dynamically adapt to changes in system state, and single-dimensional behavioral analysis models have limited ability to capture spatiotemporal correlation features, resulting in test results that struggle to accurately pinpoint the causal link between performance degradation and security vulnerabilities. To address these issues, there is an urgent need to construct an integrated testing framework that combines dynamic load injection, multi-dimensional behavioral modeling, and risk correlation analysis. Through intelligent scenario simulation and data-driven decision-making mechanisms, this framework can achieve comprehensive evaluation capabilities of the system under extreme loads and mixed attack scenarios, providing technical support for the stability optimization and security assurance of modern computer systems. Summary of the Invention

[0005] The purpose of this invention is to address the problems existing in the background technology by proposing a computer performance and security testing method and system.

[0006] The technical solution of this invention: a computer performance security testing method, comprising the following implementation steps:

[0007] S1. Collect performance data, behavioral data, and security event data of the computer system under test, and standardize the collected data using Z-score.

[0008] S2. Construct a multi-dimensional behavioral baseline model for the testing phase. Construct behavioral features by dimensionality reduction through sliding window and principal component analysis. Use Gaussian mixture model clustering to establish normal behavior pattern clusters. Combine hidden Markov model to analyze temporal state transitions, detect anomalies, and predict system degradation and attack paths.

[0009] S3. Simulation paths are generated by constructing scene behavior vectors and state mapping matrices. A weighted combined load scheduling strategy is used to dynamically adjust the load intensity and timing. An abnormal behavior chain is constructed and a disturbance function is introduced. The test strategy is adjusted in real time by combining a feedback adjustment mechanism.

[0010] S4. By collecting multi-dimensional performance indicators and abnormal event sequences after load injection, construct an event-driven causal performance graph model, define the directed weighted association between abnormal event nodes and performance indicator nodes, quantify the impact of abnormal behavior on performance, calculate the system risk index, and trigger dynamic alarms.

[0011] S5 outputs performance bottlenecks, security vulnerabilities, and risk scores and recommendations reports, and archives test data.

[0012] The preferred process for constructing a multidimensional behavioral baseline model for the testing phase is as follows:

[0013] S21. Divide the data according to the sliding window mechanism to form a time series feature sequence. F t =[x'1(t),x'2(t),...,x' i (t),...,x' n [t], principal component analysis is used for dimensionality reduction to obtain a low-dimensional behavioral representation, i.e., the system behavioral feature vector:

[0014] Where, x' i (t) represents the standard data at time t for the i-th data point; F t This represents the standardized behavioral feature vector formed over the time window t; n represents the dimension of the original standardized features; T represents the length of the time window. Z represents the d-dimensional real space; d represents the dimension after dimensionality reduction; φ(·) represents the principal component analysis method;t This represents the behavioral characteristics over time t.

[0015] S22, Constructing Feature Samples Define a Gaussian mixture model, where the behavior vectors are weighted combinations following a multivariate Gaussian distribution: feature samples Clustered into k clusters;

[0016] Where k represents the number of clusters of behavioral patterns; π i Let the weight of the i-th Gaussian component satisfy the following condition: μ' i E represents the center of the i-th behavior cluster; i Let represent the covariance matrix of the i-th row cluster; P(Z) represents the multidimensional Gaussian distribution density function; t () indicates a weighted combination;

[0017] And obtain the real-time behavior vector Z new After processing by the clustering model, if the real-time behavior vector Z new Mahalanobis distance D i (Z new If the value is greater than δ, it is judged as abnormal behavior;

[0018]

[0019] Where δ is the behavior deviation threshold;

[0020] S23. The clustered behavior sequence is modeled temporally using a Hidden Markov Model, the mapping relationship between state transition and observation probability is defined, the Baum-Welch algorithm is used to train the model parameters, the Viterbi algorithm is used to predict the future state path of the system, and the transition matrix is ​​analyzed to identify abnormal frequency increases and new states.

[0021] Preferably, the process of performing time-series modeling on the clustered behavioral sequences using a Hidden Markov Model is as follows:

[0022] S31. Obtain the behavior sequence for clustering modeling: S = {s1, s2, ..., s} t ,...,s T},s t ∈{1,2,...,k};

[0023] Where T represents the length of the time window; s t This represents the cluster number corresponding to time t;

[0024] S32. Use a Hidden Markov Model to establish the probability mapping relationship between state transition and observation, and define the HMM model quintuple λ=(A,B,π',Q,O).

[0025] Where Q = {q1,...,q} j ,...,q N} represents the implicit behavioral state q j Set; O = {o1,...,o} i ,...,o k} represents the cluster label for observable behavior; o i The i-th row represents the cluster label; π' represents the initial state probability vector, A = {a ij} represents the state transition matrix, i.e., the probability of transitioning from state i to state j; B = {b j (o i )} represents the observation probability matrix, i.e., in state q j The following observations were made of o. i The probability of;

[0026] S33. Perform state path inference using the Viterbi algorithm on a given observation sequence S: Q * =argmaxP(Q|S,λ), predicts the state the system will enter within the next m steps;

[0027] Among them, Q * Indicates the most likely state path;

[0028] S34. By analyzing the transition probability matrix A, potential problems are identified.

[0029] Preferably, the process of generating the simulation path by constructing the scene behavior vector and state mapping matrix is ​​as follows:

[0030] S41. Based on the multidimensional behavior clustering results and abnormal sequence states, construct the scene behavior vector: S i ={F i1 ,F i2 ,...,F ij ,...,F in The simulation path is constructed using the state mapping matrix: M:S i →{Es j A k};

[0031] Among them, S i F represents the behavior state vector of the i-th simulation scenario; ij Represents the state value of behavior dimension j; n represents the number of behavior dimensions; Es j Indicates the required system load events; A k M: Represents the abnormal behavior injection event; M: Represents the mapping function from behavior state to the injected event;

[0032] S42. By employing a weighted combined load scheduling strategy through on-demand combination, weighted driving, and timing control, the simulation intensity and behavior path are dynamically adjusted.

[0033] Where L(t) represents the total load at time t; f i (t) represents the i-th type of load function (including but not limited to CPU computation, I / O write, and network request); ω i The weight of the i-th load type is indicated (depending on the importance of the behavior in the scenario); N represents the total number of load types.

[0034] S43. By defining an abnormal behavior chain that includes attack operations and waiting time, a perturbation function is introduced to insert no-operation, adjust the order, or set a mask instruction to generate an abnormal behavior chain.

[0035] S44. Inject the constructed load flow and abnormal behavior chain into the target system, collect the system response status in real time, construct a feedback adjustment mechanism, and construct the state evaluation and strategy adjustment function Feedback(t) = h(St t ,L(t),R(t));

[0036] Among them, St t L(t) represents the system state at time t; L(t) represents the load pressure at time t; R(t) represents the system response; and h(·) represents the strategy function.

[0037] Preferably, the abnormal behavior chain generation process is as follows:

[0038] S51. Define an abnormal behavior chain C:

[0039] Where C represents the abnormal behavior chain; a i This represents the i-th attack operation; τi represents the waiting time between operations;

[0040] S52. Introduce the disturbance function: C' = C + ε(t);

[0041] Where ε(t) represents the perturbation term; C' represents the abnormal behavior chain after the perturbation term is introduced.

[0042] Preferably, the process of constructing the event-driven causal performance graph model is as follows:

[0043] S61. Based on each round of load and anomaly injection process, collect the system's multidimensional performance response index P at time t. t The sliding window is used for normalization and smoothing to form a time series of performance indicators based on time alignment.

[0044] S62. Collecting abnormal behavior chain injection time and event sequence: ε={(ti ,e i ,c i )};

[0045] Among them, e i Indicates the label of the i-th exception event; t i Indicates the corresponding timestamp; c i Indicates contextual information about the abnormal event;

[0046] S63. Define an event-driven causal performance graph and define the directed weighted association between abnormal event nodes and performance indicator nodes. Calculate the response intensity of abnormal behavior to performance indicators using the observation window, filter significantly influential edges based on the threshold and generate a weight matrix, and output the event-driven causal performance graph.

[0047] Preferably, the process for generating an event-driven causal performance graph is as follows:

[0048] S71. Define a directed graph model G = (V, E);

[0049] Where the node set V: V = V e ∪V p , by abnormal event node V e With performance index node V p Composition; E represents the set of directed edges;

[0050] S72. Establish a set of directed edges E and relation weights, where each edge, i.e., e... i →p k , indicating abnormal behavior e i For performance index p k The direct impact path;

[0051] Assign a weight ζ to each edge ik :

[0052] Where, ζ ik Indicates abnormal behavior e i For performance index p k Influence intensity; t i Indicates abnormal behavior e i The injection time point; τ represents the observation window length; p k (t i +τ) represents performance data after anomaly injection; p k (t i () indicates instantaneous performance data before injection;

[0053] S73, if ζ ik >θ k Then it is considered that abnormal behavior affects the performance index p. k This had a significant impact, and the edge is preserved in the graph;

[0054] Where, θ k This indicates the threshold value set for the indicator dimension;

[0055] S74, Output graph G = (V, E, W);

[0056] Where V represents the set of nodes; E represents the set of directed edges; W = {ζ ik} represents the weight matrix for each edge.

[0057] Preferably, the calculation process for the system risk index is as follows:

[0058] If Risk t If the value is greater than Θ, a risk warning will be issued, and dynamic protection will be triggered immediately.

[0059] Where, ω ij Indicates event e i Weights; Risk t Θ represents the system risk value at the current moment; Θ represents the upper limit of system risk.

[0060] The technical solution of the present invention: a computer performance security testing system, used to execute the above-mentioned computer performance security testing method, characterized in that it includes:

[0061] The data acquisition module is used to collect resource usage data during system operation and to simultaneously collect system behavior monitoring data.

[0062] The multidimensional behavior analysis module is used to model system behavior patterns using clustering and time series models, and to establish multidimensional behavior baselines under normal and abnormal states.

[0063] The dynamic load injection module is used to inject different types of load into the target system through a user behavior simulator, simulating mixed injection of attack loads;

[0064] The performance-security correlation analysis module is used to evaluate performance and security metrics in real time and call risk functions.

[0065] The test report generation module is used to output reports and update the knowledge base, and automatically marks potential security vulnerabilities that appear under high load / high concurrency.

[0066] Compared with the prior art, the above-mentioned technical solution of the present invention has the following beneficial technical effects:

[0067] This invention designs a computer performance and security testing method and system. By integrating Gaussian Mixture Model (GMM) and Hidden Markov Model (HMM), it achieves collaborative modeling of system behavior in spatial clustering and temporal evolution, significantly improving the comprehensiveness and accuracy of anomaly detection and effectively reducing the false alarm rate. A weighted combination strategy is employed to inject normal and attack loads, combined with a perturbation function to generate diverse abnormal behavior chains, breaking through the static scenario limitations of traditional testing tools. This allows for the simulation of the coupling effect of performance and security threats in real-world environments, triggering complex vulnerabilities that are difficult to cover using traditional methods. A directed weighted association model is constructed based on Event-Driven Causal Performance Graph (ECPG) to quantify the causal impact of abnormal events on performance indicators, accurately locate risk paths, and provide interpretable analysis results, providing data-driven decision support for system optimization. The self-evolution mechanism of the knowledge base continuously improves the system's detection capability and adaptability to unknown attack patterns by archiving test data and risk paths and retraining model parameters, forming a closed-loop optimization process. The overall solution achieves significant improvements in testing efficiency, scenario coverage depth, and risk warning capabilities, providing an innovative solution for the integrated performance and security assessment of complex computer systems. Attached Figure Description

[0068] Figure 1 This is a system architecture diagram of a computer performance security testing system proposed in this invention;

[0069] Figure 2 This is a flowchart of a computer performance security testing method proposed in this invention. Detailed Implementation

[0070] Example 1, as Figure 1 As shown, the computer performance and security testing system proposed in this invention includes: a data acquisition module, a multi-dimensional behavior analysis module, a dynamic load injection module, a performance-security correlation analysis module, and a test report generation module.

[0071] The data acquisition module collects system runtime resource usage data (including but not limited to CPU, memory, I / O, and network), and simultaneously collects system behavior monitoring data (including but not limited to process behavior, system calls, abnormal event logs, and security alarm data).

[0072] The multidimensional behavior analysis module uses clustering and time series models to model system behavior patterns and establish multidimensional behavior baselines under normal and abnormal states.

[0073] The dynamic load injection module injects different types of load into the target system through user behavior simulators (including but not limited to virtual users and interface simulators), simulating mixed injection of attack loads (including but not limited to denial of service, abnormal authorized access, etc.);

[0074] The performance-security correlation analysis module evaluates performance and security metrics in real time and invokes risk functions.

[0075] The test report generation module outputs reports and updates the knowledge base, and automatically marks potential security vulnerabilities that appear under high load / high concurrency.

[0076] Example 2, as Figure 2 As shown, the present invention proposes a computer performance security testing method, which is applied to a computer performance security testing system proposed in Embodiment 1. The specific implementation steps are as follows:

[0077] S1. According to the preset test strategy, load the environmental information, test objectives and parameter configuration of the computer device under test, including but not limited to the resource specifications, interface call methods, security boundary policies and fault tolerance configuration rules of the target system;

[0078] With the target system in baseline operating condition, activate the data acquisition module and continuously collect the following content:

[0079] Performance metrics include, but are not limited to, CPU load, memory usage, disk I / O, and network latency.

[0080] Behavioral characteristics include, but are not limited to, process call chains, system call logs, and exception event triggering conditions.

[0081] Security incidents include, but are not limited to, changes in login status, open ports, and abnormal access control.

[0082] For each type of raw data x i (t) Perform Z-score normalization at each time slice t:

[0083]

[0084] Where, x i (t) represents the i-th original data point; μ i Represents the original data x i (t) Historical average of data type; σ i Represents the original data x i (t) Historical standard deviation of the data type; x' i (t) represents standardized data representing historical standard deviations;

[0085] Standardized data is transmitted to the multidimensional behavior analysis module.

[0086] S2. The multi-dimensional behavior analysis module constructs a multi-dimensional behavior baseline model for the testing phase based on performance, behavior, and security log data. Its specific implementation process is as follows:

[0087] S21. Behavioral feature construction and dimensionality reduction: This involves integrating multi-dimensional data vectors into a unified behavioral representation and performing dimensionality reduction to extract high-value features.

[0088] S2101. Divide the data according to the sliding window mechanism to form a time series feature sequence. F t =[x'1(t),x'2(t),...,x' n (t)];

[0089] Among them, F t This represents the standardized behavioral feature vector formed over the time window t; n represents the dimension of the original standardized features; T represents the length of the time window.

[0090] S2102. Principal component analysis (PCA) is used for dimensionality reduction to obtain a low-dimensional behavioral representation:

[0091] in, Z represents the d-dimensional real space, which is the set of all vectors consisting of d real numbers; d represents the dimension after dimensionality reduction; φ(·) represents the PCA method; Z t This represents the behavioral characteristics over time t.

[0092] S22. Multidimensional behavioral pattern clustering modeling involves unsupervised learning modeling of the system's behavioral feature vectors after dimensionality reduction. Clustering algorithms are used to identify and classify behavioral patterns in the system's operating states at different time slices, establishing "normal behavioral pattern clusters." When new behavioral features deviate from these clusters, they can be quickly identified as potential abnormal states or attack operations. Specifically:

[0093] S2201, Constructing Feature Samples

[0094] S2202. Define a Gaussian Mixture Model (GMM), where the behavior vectors are a weighted combination of multiple Gaussian distributions:

[0095] Where k represents the number of clusters of behavioral patterns; π i Let the weight of the i-th Gaussian component satisfy the following condition: μ' i E represents the center of the i-th behavior cluster; i Let represent the covariance matrix of the i-th behavior cluster, describing the degree of dispersion of the behavior; P(Z) represents the multidimensional Gaussian distribution density function; t () indicates a weighted combination;

[0096] It should be noted that by training the model using the Expectation-Maximization (EM) algorithm, the cluster centers μ' are obtained. i Covariance matrix E i Weight π i ;

[0097] Therefore: feature samples The system is clustered into k clusters, each cluster representing a "typical behavior pattern of the system";

[0098] S2203. Obtain the real-time behavior vector Z new After processing by the clustering model, the category to which a point belongs or whether it is an outlier is determined by calculating the Mahalanobis distance to each cluster center.

[0099]

[0100] If the following condition is met, it is judged as "abnormal behavior": real-time behavior vector Z new Mahalanobis distance D i (Z new )>δ, where δ is the behavior deviation threshold;

[0101] S23. Utilize time-series modeling methods to model the clustered behavioral pattern sequences, uncover the patterns of system behavior changes over time, identify potential system degradation trends, covert attack paths, or abnormal state transition probabilities, and further enhance the depth and breadth of system performance and security detection. Specifically:

[0102] S2301. Obtain the behavior sequence for clustering modeling: S = {s1, s2, ..., s} t ,...,s T},s t ∈{1,2,...,k};

[0103] Where T represents the length of the time window; s t This represents the cluster number corresponding to time t, indicating that the system is in a specific "behavioral state".

[0104] S2302. A Hidden Markov Model (HMM) is used to establish the probabilistic mapping relationship between state transitions and observations. The HMM model quintuple λ = (A, B, π', Q, O) is defined.

[0105] Where Q = {q1,...,q} j ,...,q N} represents the implicit behavioral state q j Sets (including but not limited to "normal operation", "degradation", "high risk"); O = {o1,...,o i ,...,o k} represents the clustering label for observable behavior (output by GMM); o i Let represent the cluster label of the i-th row; π' represents the initial state probability vector, i.e., the probability of the system being in each hidden state initially; A = {a ij} represents the state transition matrix, i.e., the transition probabilities between hidden states, that is, the probability of transitioning from state i to state j; B = {b j (o i )} represents the observation probability matrix, i.e., in state q j The following observations were made of o. i The probability that hidden state j generates observation o i The probability of;

[0106] It should be noted that the Baum-Welch algorithm (EM iteration) is used to perform unsupervised learning on the model. The training objective is to maximize the likelihood estimate P(O|λ) of the system behavior state sequence, and finally output the state transition probability matrix A, the observation probability matrix B, and the initial state distribution π.

[0107] S2303. Using the Viterbi algorithm, infer the most probable state path for a given observation sequence S: Q * =argmaxP(Q|S,λ), predicts the state the system will enter within the next m steps (including but not limited to abnormal risk states);

[0108] Among them, Q * Indicates the most likely state path;

[0109] Based on this, by analyzing the transition probability matrix A, the following potential problems are identified: increased frequency of anomalous transitions, emergence of new states, and enhanced state jumps.

[0110] The S3 dynamic load injection module constructs a highly realistic and controllable test scenario by intelligently scheduling simulated traffic, environmental state disturbances, and behavioral link reproduction, thus integrating performance testing and security testing. Its specific implementation process is as follows:

[0111] S31. Based on the multidimensional behavior clustering results and abnormal sequence states output in step S3, construct the scene behavior vector: S i ={F i1 ,F i2 ,...,F ij ,...,F in};

[0112] Among them, S i F represents the behavior state vector of the i-th simulation scenario; ij This represents the state value of behavior dimension j; n represents the number of behavior dimensions (including but not limited to CPU utilization, disk I / O, and call chain depth).

[0113] Constructing simulation paths using state mapping matrices: M:S i →{Es j A k};

[0114] Among them, Es j Indicates the required system load events (including but not limited to high-concurrency HTTP, memory overflow simulation); A k M: Represents abnormal behavior injection events (including but not limited to simulated SQL injection and malicious process creation); M: Represents the mapping function from behavior state to injection event, which is jointly trained and generated by expert knowledge and historical pattern mining;

[0115] S32. Utilize control functions to schedule different load types and intensities, i.e., through on-demand combination + weighted driving + timing control, adopt a weighted combined load scheduling strategy to dynamically adjust the simulation intensity and behavior path:

[0116] Where L(t) represents the total load at time t; f i (t) represents the i-th type of load function (including but not limited to CPU computation, I / O write, and network request); ω i The weight of the i-th load type is indicated (depending on the importance of the behavior in the scenario); N represents the total number of load types.

[0117] For example, f i (t) represents the i-th type of load function: f1(t): CPU loop calculation; f2(t): high concurrency disk read / write; f3(t): IO latency simulation; f4(t): memory heap expansion; f5(t): RPC or REST call simulation;

[0118] It should be noted that the weighting strategy is as follows: Where Imp(f) i The score represents the importance score derived from the proportion and activity of various resources in the behavior sequence of step S3.

[0119] S33. Based on the abnormal evolution paths (including but not limited to the attack chain and kill chain) in the behavior model, construct a dynamic behavior injection chain, specifically as follows:

[0120] S3301. Define an abnormal behavior chain C:

[0121] Where C represents the abnormal behavior chain; a i τi represents the i-th attack operation (including but not limited to script creation, remote download, and privilege escalation); τi represents the waiting time between operations, simulating the rhythm of a real attack.

[0122] S3302. Introduce a perturbation function to enhance the diversity and recurrence rate of anomaly chains: C'=C+ε(t);

[0123] Where ε(t) represents the perturbation term (including but not limited to insertion of no-operation, reordering, and setting mask instructions); C' represents the abnormal behavior chain after the perturbation term is introduced;

[0124] S34. Inject the constructed load flow and exception chain into the target system, collect the system response status in real time, construct a feedback adjustment mechanism, and construct the state evaluation and strategy adjustment function Feedback(t) = h(St t ,L(t),R(t));

[0125] Among them, St t L(t) represents the system state at time t; L(t) represents the load pressure at time t; R(t) represents the system response (including but not limited to response time, number of abnormal alarms, and memory fluctuations); h(·) represents the policy function.

[0126] It should be noted that the strategy function h(·) controls whether to: increase the load, change the scenario, stop the test, or mark the performance bottleneck based on the feedback results.

[0127] S4, the performance-security correlation analysis module, is based on the dynamic injection results of step S3. It aims to construct a coupled correlation model between performance metrics and security events, providing decision support for bottleneck identification and risk assessment in complex testing environments. Its specific implementation process is as follows:

[0128] S41. Based on each round of load / anomaly injection process, collect the system's multidimensional performance response index P at time t. t CPU utilization Memory usage Disk I / O throughput Network transmit / receive rate Response delay Number of abnormal alarms A sliding window is used for normalization and smoothing to form a time-aligned performance index time series.

[0129] S42. Data Acquisition Behavior Chain Injection Time and Event Sequence: ε={(t i ,e i ,c i )};

[0130] Among them, e i This represents the label of the i-th abnormal event (including but not limited to abnormal login, abnormal system call, and command injection); t i Indicates the corresponding timestamp; c iContextual information representing the abnormal event, including but not limited to thread ID, process call stack, and user identifier;

[0131] S43. Propose ECPG (Event-driven Causal Performance Graph), which uses the system's performance response as the effect variable and injected anomalies as the cause variable, and constructs a directed weighted graph to achieve refined risk path reasoning, specifically:

[0132] S4301. Construct a directed graph model G = (V, E);

[0133] Where the node set V: V = V e ∪V p , by abnormal event node V e With performance index node V p Composition; E represents the set of directed edges;

[0134] It should be noted that the abnormal event node V e Each node represents an anomaly type, including but not limited to SQL injection e1, remote command execution e2, denial-of-service attack e3, high-frequency I / O access e4, unauthorized access e5, and privilege escalation attempt e6.

[0135] Performance index node V p That is, including but not limited to CPU utilization. Memory usage Disk I / O throughput Network transmit / receive rate Response delay Number of abnormal alarms

[0136] S4302. Establish a set of directed edges E and relation weights, where each edge (e...) i →p k ) indicates "abnormal behavior e" i "Regarding the performance index p" k The direct impact path of "" is determined by assigning a weight ζ to each edge. ik , indicating the response intensity:

[0137] Where, ζ ik Indicates an exception e i For performance index p k Influence intensity; t i Represents the timestamp, i.e., exception e i The injection time point; τ represents the observation window length; p k (t i +τ) represents performance data after anomaly injection; p k(t i () indicates instantaneous performance data before injection;

[0138] If ζ ik >θ k If the threshold of the indicator dimension is reached, it is considered that the abnormal behavior has a significant impact on the performance indicator, and the edge is retained in the graph.

[0139] S4303, Output graph G = (V, E, W);

[0140] Where V represents the set of nodes (events and performance); E represents the set of directed edges; W = {ζ ik} represents the weight matrix for each edge;

[0141] S44. Based on the established causal graph, construct the overall system risk index:

[0142] Where, ω ij Indicates event e i The weight of Risk is set according to its severity level; t This represents the system risk value at the current moment, reflecting the strength of the performance-security coupled threat to the system under the current test scenario;

[0143] S45. Set the system risk cap Θ, if Risk t If the value is greater than Θ, a risk warning will be issued, and dynamic protection will be triggered immediately.

[0144] S5. The test report generation module archives and outputs the analysis results, including:

[0145] Performance evaluation report (bottleneck points, limit points, resource usage trends);

[0146] Security vulnerability report (abnormal call path, location where security policy is invalid);

[0147] Risk assessment and recommendations (including but not limited to system architecture optimization recommendations and security strategy enhancement recommendations);

[0148] The data features, risk findings, and system response behaviors generated in this round of testing are archived into a built-in knowledge base for model optimization and risk factor retraining in subsequent testing tasks, thereby improving the intelligent adaptive capabilities of the testing system.

[0149] The embodiments of the present invention have been described in detail above with reference to the accompanying drawings. However, the present invention is not limited thereto. Various changes can be made within the scope of knowledge possessed by those skilled in the art without departing from the spirit of the present invention.

Claims

1. A computer performance security testing method, characterized by, The embodiment comprises the following steps: S1, collecting performance data, behavior data and security event data of the computer system to be tested, and performing Z-score standardization on the collected data; S2, constructing a multi-dimensional behavior baseline model for the test phase, constructing behavior characteristics through sliding window and principal component analysis dimension reduction, establishing normal behavior pattern clusters using a Gaussian mixture model clustering, analyzing time sequence state transitions using a hidden Markov model, detecting abnormalities and predicting system degradation and attack paths; The construction process of the multi-dimensional behavior baseline model for the test phase is as follows: S21, divide the data according to sliding window mechanism to form time sequence characteristic sequence : , adopt principal component analysis to reduce dimension to obtain low-dimensional behavior expression, i.e. system behavior characteristic vector ; wherein, denotes the standardized data at time t for the i-th data point; F t denotes the standardized behavior feature vector constructed over the time window t; n denotes the original number of standardized features; T denotes the length of the time window; denotes a d-dimensional real space; d denotes the dimensionality after dimensionality reduction; denotes the principal component analysis method; Z t denotes the behavior feature representation at time t; S22, constructing a feature sample , defining a Gaussian mixture model, the behavior vector obeys a weighted combination of multivariate Gaussian distribution: , clustering the feature sample into k clusters; wherein k represents the number of clusters of behavior patterns; represents the weight of the i-th Gaussian component, satisfying ; represents the center of the i-th behavior cluster; represents the covariance matrix of the i-th behavior cluster; represents the multi-dimensional Gaussian distribution density function; represents a weighted combination; And obtain the real-time behavior vector Z new After processing by the clustering model, if the real-time behavior vector Z new Mahalanobis distance >δ indicates abnormal behavior: ; Wherein, δ is the behavior deviation threshold; S23, performing time sequence modeling on the clustered behavior sequence through the hidden Markov model, defining the state transition and observation probability mapping relationship, training the model parameters using the Baum-Welch algorithm, predicting the future state path of the system using the Viterbi algorithm, and analyzing the transition matrix to identify abnormal frequency increases and new states; S3, generating a simulation path by constructing a scenario behavior vector and a state mapping matrix, dynamically regulating the load intensity and time sequence using a weighted combination load scheduling strategy, constructing an abnormal behavior chain and introducing a disturbance function, and combining a feedback adjustment mechanism to adjust the test strategy in real time; S4, constructing an event-driven causal performance graph model by collecting multi-dimensional performance indicators and abnormal event sequences after load injection, defining the directed and weighted association between abnormal event nodes and performance indicator nodes, quantifying the influence intensity of abnormal behavior on performance, calculating the system risk index, and triggering dynamic alarms; S5, outputting performance bottlenecks, security vulnerabilities, risk scores and suggestion reports, and archiving test data.

2. The computer performance security testing method of claim 1, wherein, The process of time sequence modeling on the clustered behavior sequence through the hidden Markov model is as follows: S31, obtaining the behavior sequence for clustering modeling: ； wherein T represents the time window length; s t represents the cluster number corresponding to the t time point; S32, a hidden Markov model is used to establish a probability mapping relationship between state transition and observation, and a five-tuple of HMM model is defined ; where, represents the hidden state q j set; represents the observable behavior cluster label; o i represents the i-th behavior cluster label; represents the initial state probability vector, A={a ij represents the state transition matrix, i.e., the probability of transitioning from state i to state j; represents the observation probability matrix, i.e., the probability of observing o j in state q i . S33, state path inference on the given observation sequence S by the Viterbi algorithm: , predict the state that the system enters in the future m steps; where Q * represents the most probable state path; S34, analyze the transition probability matrix A to identify potential problems.

3. The computer performance security testing method of claim 2, wherein, The generation process of the simulation path by constructing a scenario behavior vector and a state mapping matrix is as follows: S41、According to the multi-dimensional behavior clustering result and the abnormal sequence state, a scene behavior vector is constructed. , a simulation path is constructed by using the state mapping matrix: ； where S i represents the behavior state vector of the i-th simulation scenario; F ij represents the state value of behavior dimension j; n represents the number of behavior dimensions; Es j represents the required system load event; A k represents the abnormal behavior injection event; M: represents the mapping function of behavior state to injection event; S42, by on-demand combination + weight drive + timing control, adopt weighted combination load scheduling strategy, dynamically regulate simulation intensity and behavior path: ; where L(t) represents the integrated load at time t; represents the i-th load function; represents the weight of the i-th load type; N represents the total number of load types; S43, generate an abnormal behavior chain by defining an abnormal behavior chain containing attack operations and waiting time, introducing a disturbance function to insert empty operations, adjust the order or set a mask instruction, and generating an abnormal behavior chain; S44, inject the constructed load flow and abnormal behavior chain into the target system, collect the system response state in real time, build a feedback adjustment mechanism, and build a state evaluation and strategy adjustment function ; where St t denotes the system state at time t; L(t) denotes the load pressure at time t; R(t) denotes the system response; denotes the policy function.

4. The computer performance security testing method of claim 3, wherein, The abnormal behavior chain generation process is as follows: S51, define an abnormal behavior chain C: ; where C denotes a chain of abnormal behaviors; a i denotes the ith attack operation; denotes the waiting time between operations; S52, introducing a perturbation function: ; wherein, represents a perturbation term; represents the abnormal behavior chain with the perturbation term introduced.

5. The computer performance security testing method of claim 1, wherein, The construction process of the event-driven causal performance graph model is as follows: S61、based on each round of load and anomaly injection process, the acquisition system collects the multi-dimensional performance response index P of the system at time t t and adopts a sliding window for normalization and smoothing to form a set of time-aligned performance index time series; S62, collect abnormal behavior chain injection time and event sequence: ; wherein e i represents the i-th abnormal event label; t i represents the corresponding timestamp; c i represents the context information of the abnormal event; S63, define the event-driven causal performance graph, define the directed and weighted association between abnormal event nodes and performance indicator nodes, calculate the response intensity of abnormal behavior to performance indicators using an observation window, filter significant influence edges according to a threshold, generate a weight matrix, and output the event-driven causal performance graph.

6. The computer performance security testing method of claim 5, wherein, The generation process of the event-driven causal performance graph is as follows: S71, define the directed graph model G=(V,E); Wherein, the node set V: , the abnormal event node V e , the performance index node V p ; E represents a directed edge set; S72, a directed edge set E and relationship weights are established, each edge, i.e. e i → p k , represents the direct influence path of the abnormal behavior e i on the performance indicator p k ; assigning weights to each edge : ; wherein, represents the abnormal behavior e i the impact strength on the performance indicator p k ; t i represents the abnormal behavior e i the time point of injection; represents the observation window length; represents the performance data after the abnormal injection; represents the instantaneous performance data before injection; S73, if >θ k The abnormal behavior is considered to have a significant impact on the performance indicator p k The edge is retained in the graph. wherein θ k denotes a set index dimension threshold value; S74, output the graph G=(V,E,W); where V represents a set of nodes; E represents a set of directed edges; W={ } represents a weight matrix of each edge.

7. The computer performance security testing method of claim 6, wherein, The calculation process of the system risk index is as follows: ; If then a risk warning is given and dynamic protection is triggered immediately; wherein, represents the event e i weight; represents the current time system risk value; represents the system risk upper limit.

8. A computer performance security testing system for performing the computer performance security testing method of any one of claims 1 to 7, characterized by It comprises: A data acquisition module for acquiring system runtime resource usage data and synchronously collecting system behavior monitoring data; A multi-dimensional behavior analysis module for modeling system behavior patterns using a clustering + time series model, and establishing a multi-dimensional behavior baseline under normal and abnormal states; A dynamic load injection module for injecting different types of loads into the target system through a user behavior simulator to simulate mixed attack-type load injection; Performance-security correlation analysis module for real-time evaluation of performance and security indicators, calling risk functions; Test report generation module for outputting reports and updating the knowledge base and automatically marking potential security hazard points that occur under high load / high concurrency.

Images