Information system operation risk early warning method, system and equipment

Abstract

The invention discloses an information system operation risk early warning method, system and device, and particularly relates to the technical field of operation safety and risk early warning, and the method comprises the following steps: collecting user data to generate an operation log correlation index; generating a data transmission integrity coefficient based on the operation log correlation index; generating a multi-source data correlation matrix based on the integrity coefficient; generating a multi-dimensional abnormal association degree threshold value based on the multi-source data association degree matrix; and generating an operation and maintenance risk early warning level and a disposal suggestion based on the multi-dimensional abnormal association degree threshold. Through multi-link data processing, multi-technology fusion and multi-dimensional analysis, the operation risk early warning efficiency of the information system is improved, user operation behavior data is collected, cleaned and screened, the field frequency is counted in combination with the standard log template and the precise time window, the operation log correlation index accuracy is improved, and the operation efficiency is improved. And a reliable data foundation is laid for subsequent analysis.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of operation and maintenance safety and risk early warning, in particular to an information system operation and maintenance operation risk early warning method, system and device. BACKGROUND

[0002] Operation and maintenance safety and risk early warning technology focuses on the whole life cycle of the system, uses intrusion detection, security audit and other technologies to monitor the system state, security events and network activities in real time, ensures the stable operation of the system through a series of strategies, identifies potential risk factors in advance, and realizes effective control of security risks. The information system operation and maintenance operation risk early warning method collects log information such as user login and operation commands, and system running indexes such as CPU usage and memory occupancy rate for key components such as servers and network devices, judges the risk through algorithm analysis, and issues an early warning signal in time. The prior art has many deficiencies, log processing only makes basic collection, lacks cleaning and field statistics, and affects analysis accuracy; data transmission does not use technologies such as block chain to ensure integrity, and is prone to risk misjudgment due to data abnormalities; multi-source data analysis stays at the surface collection and does not deeply integrate and mine data correlation; the risk early warning dimension is single, no multi-dimensional threshold grading is set, and it is difficult to cope with complex risk scenarios, such as when memory abnormalities and normal logins coexist, it is difficult to accurately assess the risk level, and affects the safety of system operation and maintenance. SUMMARY

[0003] The main purpose of the present application is to provide an information system operation and maintenance operation risk early warning method, system and device, which can effectively solve the problems involved in the background technology.

[0004] To achieve the above purpose, the technical scheme adopted by the present application is: An information system operation and maintenance operation risk early warning method, comprising the following steps: S1, collecting user operation behavior data to generate operation log correlation degree indexes; S2, generating data transmission integrity coefficients based on the generated operation log correlation degree indexes; S3, after obtaining the data transmission integrity coefficients, integrating related data to generate a multi-source data correlation degree matrix; S4, setting multi-dimensional abnormal correlation degree thresholds according to the multi-source data correlation degree matrix; S5, generating operation and maintenance risk early warning levels and disposal suggestions according to the multi-dimensional abnormal correlation degree thresholds.

[0005] Preferably, the operation log correlation degree indexes generated in S1 specifically include the following steps: S1.1, the system API interface collects operation behavior data in real time, the operation behavior data includes but is not limited to user login time, operation instruction type, operation object, operation terminal IP address, the data collected is cleaned, and repeated data and invalid data are removed, and valid data is screened out for subsequent analysis; S1.2, the number of occurrences of each log field when the operation instruction is executed is counted, and the log field correlation degree value is obtained by comparing with the system preset reference instruction log template; The reference instruction log template is generated based on system historical normal operation data, and includes the typical log field combination corresponding to each instruction type.

[0006] Preferably, S2 includes the following steps in generating the data transmission integrity coefficient: S2.1, based on the operation log correlation degree index, the collected log data is divided into data blocks, and the hash value of each data block is obtained by hash operation, and the data block hash value is generated; S2.2, the current time is obtained as a time stamp, the hash value and the time stamp are added to the corresponding data block, the data block is organized according to the block chain structure, and the chain data block is generated; S2.3, the data packet is verified according to the time stamp sequence at the receiving end, the hash value of each data packet is recalculated, and the calculated hash value is compared with the hash value carried by the data packet, if the two hash values are not equal, the sending end is requested to retransmit the data packet, and the network exception is recorded, and the data transmission integrity coefficient is generated based on the hash value comparison result and the retransmission number.

[0007] Preferably, S3 includes the following steps in generating the multi-source data correlation matrix: S3.1, the data transmission integrity coefficient is called, the characteristic value of the user operation behavior correlation log data transmitted is integrated with the system log data characteristic value, and the user-system integrated characteristic value is generated; S3.2, the user-system integrated characteristic value is integrated with the user behavior data characteristic value, based on the analysis of user operation instruction, the instruction itself characteristic value, the system log error information characteristic value and the user access frequency characteristic value are obtained, and the multi-source integrated characteristic value is generated; S3.3, the consistency and difference of different data source characteristic values are compared and logically judged, the clustering analysis method is used to identify the correlation mode between data, and the multi-source data correlation matrix is generated based on the closeness of the correlation mode.

[0008] Preferably, S4 includes the following steps in generating the multi-dimensional abnormal correlation degree threshold value: S4.1, for the multi-source data correlation matrix, set the operation and maintenance operation instruction dimension, combine the information system historical operation data and the safety policy, determine the abnormal operation judgment condition, when the operation and maintenance operation instruction dimension appears abnormal, generate the operation and maintenance instruction abnormal index; S4.2, call the database server memory remaining amount value of the system performance index dimension, judge whether it is lower than 10%, generate the system memory state value; S4.3, call the user login record of the user behavior dimension, judge whether there is an unauthorized user logging in more than a set value within a certain time, generate the user login abnormal value; S4.4, combine the operation and maintenance instruction abnormal index, the system memory state value, the user login abnormal value, generate the multi-dimensional abnormal correlation threshold.

[0009] Preferably, S5 generates operation and maintenance risk warning level and disposal suggestion, which specifically includes the following steps: S5.1, according to the multi-dimensional abnormal correlation threshold, adopt the hierarchical warning rule to judge the risk level: when 3 or more dimensions appear serious abnormality at the same time, trigger high risk warning; When 1-2 dimensions appear moderate abnormality, trigger medium risk warning; When only a single dimension appears mild abnormality, trigger low risk warning; S5.2, combine the warning level and the abnormal dimension specific data to generate the operation and maintenance risk warning level; S5.3, according to the operation and maintenance risk warning level and the abnormal dimension specific data, generate the risk detail description; S5.4, for different risk levels and abnormal conditions, formulate corresponding disposal suggestions.

[0010] Preferably, when collecting operation behavior data in S1.1, the instruction execution time is taken as the center, and the log data within 60 seconds before and after is accurately extracted to count the operation instruction log field frequency.

[0011] Preferably, when generating chain data block in S2.2, according to the requirement of the block chain chain structure, it is ensured that each data packet accurately contains the hash value of the previous data packet.

[0012] An information system operation and maintenance operation risk warning system for executing the above information system operation and maintenance operation risk warning method, the system comprises the following modules: Operation log correlation index generation module, for executing S1 to generate operation log correlation index; Data transmission integrity coefficient generation module, for executing S2 to generate data transmission integrity coefficient; Multi-source data correlation matrix generation module, for executing S3 to generate multi-source data correlation matrix; The multidimensional anomaly correlation threshold generation module is used to perform the generation of multidimensional anomaly correlation thresholds as described in S4; The module for generating operation and maintenance risk warning levels and handling suggestions is used to perform the generation of operation and maintenance risk warning levels and handling suggestions as described in S5.

[0013] An information system operation and maintenance risk early warning device includes a processor and a memory. The memory stores the aforementioned information system operation and maintenance risk early warning system, and the processor is used to run the aforementioned information system operation and maintenance risk early warning system.

[0014] Compared with the prior art, the present invention has the following beneficial effects: 1. This invention improves the early warning efficiency of information system operation and maintenance risks through multi-stage data processing, multi-technology integration, and multi-dimensional analysis. It collects, cleans, and filters user operation behavior data, and combines benchmark log templates with precise time windows to statistically analyze field frequencies, thereby improving the accuracy of operation log correlation indicators and laying a reliable data foundation for subsequent analysis.

[0015] 2. This invention introduces blockchain technology to ensure data transmission quality. Data blocks are divided based on the correlation index of operation logs. Data is organized through hash operations, timestamps, and a chain structure. At the receiving end, the hash value is verified and retransmission status is recorded, generating a data transmission integrity coefficient. This effectively detects transmission anomalies, ensuring data integrity and reliability, and avoiding misjudgments due to transmission problems.

[0016] 3. This invention achieves deep integration and correlation analysis of multi-source data. It integrates feature values ​​from multi-source data such as users, systems, and behaviors, extracts dimensional information such as instructions, log errors, and access frequency, uses cluster analysis to identify data correlation patterns and generate a correlation matrix, comprehensively explores potential risk correlations, breaks through the limitations of single data dimensions, and improves the comprehensiveness and depth of risk analysis.

[0017] 4. This invention constructs a multi-dimensional hierarchical early warning system to enhance the targeted nature of risk handling. It sets multi-dimensional anomaly thresholds for a multi-source data matrix, including operational instructions, system performance, and user behavior. It generates anomaly indicators by combining historical data and security policies, uses hierarchical rules to determine risk levels, and simultaneously generates detailed descriptions and handling suggestions. This achieves accurate risk classification and targeted response, improving the timeliness of early warnings and the ability to ensure operational security. Attached Figure Description

[0018] Figure 1 This is a flowchart illustrating the overall steps of the present invention; Figure 2 Flowchart for generating the operation log correlation index of this invention; Figure 3 This is a flowchart illustrating the data transmission integrity coefficient generation process of the present invention. Figure 4 This is a flowchart of the multi-source data correlation matrix generation process of the present invention; Figure 5 This is a flowchart of the multidimensional anomaly correlation threshold generation process of the present invention; Figure 6 A flowchart is generated for the operation and maintenance risk warning level and handling suggestions of this invention; Figure 7 This is a flowchart of the early warning system of the present invention. Detailed Implementation

[0019] To make the technical means, creative features, objectives and effects of this invention easier to understand, the invention will be further described below in conjunction with specific embodiments.

[0020] like Figure 1 As shown, this invention discloses a method for early warning of risks in the operation and maintenance of information systems. The method specifically includes the following steps: S1. Collect user operation behavior data and generate operation log correlation indicators; S2. Based on the generated operation log correlation index, generate the data transmission integrity coefficient; S3. After obtaining the data transmission integrity coefficient, integrate the relevant data to generate a multi-source data correlation matrix; S4. Based on the multi-source data correlation matrix, set the multi-dimensional abnormal correlation threshold; S5. Based on the multidimensional anomaly correlation threshold, generate an operation and maintenance risk warning level and handling suggestions.

[0021] Based on the above, in the specific operation of this invention, the system API interface collects user operation behavior data in real time, processes it to generate an operation log correlation index; then, based on this index, a data transmission integrity coefficient is generated to ensure reliable data transmission; next, multi-source data is integrated to generate a correlation matrix for in-depth analysis of data relationships; multi-dimensional abnormal correlation thresholds are set according to the matrix to provide a standard for risk judgment; finally, risk warning levels and handling suggestions are generated based on the thresholds to achieve effective control over operation and maintenance risks.

[0022] Example 1, as Figure 2 As shown, this embodiment is mainly used to generate operation log correlation indicators, and specifically includes the following steps: S1.1 The system API interface collects operation behavior data in real time. The operation behavior data includes, but is not limited to, user login time, operation command type, operation object, and operation terminal IP address. The collected data is cleaned to remove duplicate and invalid data, and the valid data is selected for subsequent analysis. S1.2 Count the number of times each log field appears when the operation command is executed, and compare it with the system's preset baseline command log template to obtain the log field correlation value; The baseline instruction log template is generated based on the system's historical normal operation data and includes typical log field combinations corresponding to each instruction type.

[0023] The following section provides a further explanation of the above steps, using specific data as an example: At 09:30:15 on May 20, 2025, the bank's core transaction system collected user operation behavior data in real time through the API interface. The specific data collected was as follows: The user logged in at 09:30:15 on May 20, 2025, with the operation instruction type being a transfer transaction (code TRX001), the operation target being customer account 6222021234567890123, and the operation terminal IP address being 192.168.1.101; After data collection is complete, the system automatically performs data cleaning to remove duplicate records and invalid data such as login timeouts, and selects valid data.

[0024] Subsequently, the system counted the number of times each log field appeared when the transfer instruction was executed. The timestamp field appeared in 100% of the records (all records were covered), the transaction amount field appeared in 98% of the records, and the teller ID field appeared in 100% of the records.

[0025] Next, the frequency of these fields was compared with the system's preset baseline instruction log template. This template was generated based on historical normal transfer transaction data from the bank's core transaction system, and its typical field combination is timestamp (100%), transaction amount (100%), teller ID (100%), and counterparty account (100%). The comparison revealed that the current transaction was missing the "counterparty account" field. Based on the comparison result, the system determined that the operation was abnormal and generated a log field correlation score of 0.8 (out of 1.0).

[0026] Example 2, as Figure 3 As shown, this embodiment further processes the data based on the operation log correlation index generated in Embodiment 1, and generates a data transmission integrity coefficient, specifically including the following steps: S2.1 Based on the correlation index of operation logs, the collected log data is divided into data blocks, and a hash operation is performed on each data block to obtain a hash value, thereby generating a data block hash value; S2.2 Obtain the current time as a timestamp, add the hash value and timestamp to the corresponding data block, organize the data blocks according to the blockchain chain structure, and generate chain data blocks; S2.3 At the receiving end, the data packets are checked in order according to the timestamp, the hash value of each data packet is recalculated, and the calculated hash value is compared with the hash value carried in the data packet. If the two hash values ​​are not equal, the receiving end is requested to retransmit the data packet. At the same time, network abnormalities are recorded, and a data transmission integrity coefficient is generated based on the hash value comparison result and the number of retransmissions.

[0027] Based on the above steps, further explanation will be provided in conjunction with specific real-time data: The system takes the data collected and processed in Implementation Example 1, divides the log data into 1024KB data blocks, and performs SHA-256 hash operation on each data block; The original hash value of a certain data block is calculated as follows: 5e88489…d0d6aabbdd62…721d154.

[0028] The system obtains the current timestamp 2025-05-20T09:30:15.123Z, adds the hash value and timestamp to the corresponding data block, organizes the data blocks according to the consortium blockchain structure, and strictly ensures that each data packet accurately contains the hash value of the previous data packet, forming a chain structure.

[0029] At the receiving end, the system verifies data packets according to timestamp order, recalculates the hash value of each data packet, and compares it with the hash value carried in the data packet. In 1000 data transmissions, the number of successful receptions is recorded as S=990, the number of retransmissions as R=10, and the data transmission integrity coefficient is recorded as C. According to the formula... Calculation yields: .

[0030] Example 3, as Figure 4 As shown, this embodiment, based on embodiment two, further generates multi-source integrated feature values ​​through data transmission integrity coefficient processing and generates a multi-source data correlation matrix based on the tightness of the correlation pattern. Specifically, it includes the following steps: S3.1. Call the data transmission integrity coefficient, integrate the feature values ​​of the user operation behavior associated log data with the feature values ​​of the system log data, and generate a user-system integrated feature value. S3.2 Integrate the user-system integrated feature value with the user behavior data feature value. Based on the analysis of user operation instructions, obtain the feature value of the instruction itself, the feature value of system log error information, and the feature value of user access frequency to generate multi-source integrated feature values. S3.3 Perform numerical comparisons and logical judgments on the consistency and differences of feature values ​​from different data sources, use cluster analysis to identify the association patterns between data, and generate a multi-source data association matrix based on the tightness of the association patterns.

[0031] Based on the above, further explanation will be provided in conjunction with specific real-time data: Based on the data from Embodiment 1 and Embodiment 2, the system operates in the context of the bank's core transaction system. First, it calls the data transmission integrity coefficient generated in Embodiment 2, integrates the feature values ​​of the user operation behavior associated log data with the feature values ​​of the system log data, and generates a user-system integrated feature value. Then, it is integrated with user behavior data feature values. Based on the analysis of user operation commands, feature values ​​of the command itself, feature values ​​of system log error information, and feature values ​​of user access frequency are obtained to generate multi-source integrated feature values.

[0032] After standardizing the feature values ​​of different data sources, the K-means clustering algorithm is used to identify the association patterns between the data. Analysis revealed that 85% of large-amount transfer transactions (less than 1 million yuan) between 2:00 AM and 4:00 AM were associated with database connection timeout errors. The probability of an SQL injection attack log appearing in the system within 10 minutes of an unauthorized user logging in is 72%. Based on these association patterns, the following multi-source data association matrix is ​​generated: Table 1: Multi-source data correlation matrix Example 4, as Figure 5 As shown, this embodiment further generates anomaly indicators for operation and maintenance instructions based on the multi-source data correlation matrix generated in embodiment three. It then combines these anomaly indicators with system memory status values ​​and user login anomaly values ​​to generate a multi-dimensional anomaly correlation threshold. The specific steps include: S4.1. For the multi-source data correlation matrix, set the dimension of operation and maintenance instructions, combine the historical operation data of the information system and security policies, determine the abnormal operation judgment conditions, and generate an abnormal operation and maintenance instruction index when an abnormality occurs in the dimension of operation and maintenance instructions. S4.2. Retrieve the remaining memory value of the database server from the system performance indicator dimension, determine whether it is lower than 10%, and generate the system memory status value. S4.3 Retrieve user login records from the user behavior dimension, determine whether there are unauthorized users who have logged in more than a set number of times within a certain period of time, and generate user login anomaly values; S4.4. Combine abnormal indicators of operation and maintenance commands, system memory status values, and abnormal user login values ​​to generate a multi-dimensional abnormal correlation threshold.

[0033] Based on the above, further explanation will be provided in conjunction with the data generated in specific embodiments one to three: In this bank counter business system, operations are carried out on the multi-source data correlation matrix generated in Example 3, and the abnormal indicators of each dimension are first determined. Operation and maintenance instructions dimension: A teller processes 100-120 transfer transactions per day on a daily basis, and the system sets a threshold of ±50%; If a teller processes 200 transfer transactions on a given day, exceeding the normal range, this is considered abnormal, and an abnormal operation and maintenance indicator is generated and recorded as follows. .

[0034] System performance metrics: The system continuously monitors the remaining memory of the database server, with a threshold set at 10%. When the remaining database server memory drops to 8%, a system memory status value is generated and recorded as follows. .

[0035] User behavior dimension: The threshold for unauthorized user logins is set at 5 times per hour. If an IP address attempts to log in 8 times within 1 hour, it is considered abnormal, and a user login anomaly value is generated and recorded as follows. .

[0036] Then, combining the above three dimensions of anomaly indicators, a multidimensional anomaly correlation threshold is calculated, and the weights are determined using the Analytic Hierarchy Process (AHP). The weight of the operation and maintenance instruction dimension is denoted as... The system performance metric dimension weights are denoted as The weight of the user behavior dimension is denoted as The threshold for multidimensional anomaly correlation is denoted as T; According to the formula: calculate: Will Substituting into the formula, we get: .

[0037] Example 5, such as Figure 6 As shown, this embodiment, based on embodiments one through four, further generates an operational risk level and handling suggestions based on a multidimensional anomaly correlation threshold. Specifically: S5.1. Based on the multidimensional anomaly correlation threshold, a graded early warning rule is adopted to determine the risk level: when three dimensions show severe anomalies simultaneously (threshold > 0.8), a high-risk warning is triggered; when one or two dimensions show moderate anomalies (0.5 < threshold ≤ 0.8), a medium-risk warning is triggered; when only a single dimension shows a slight anomaly (threshold ≤ 0.5), a low-risk warning is triggered. S5.2. Based on the specific data of the early warning level and anomaly dimension, generate the operation and maintenance risk early warning level; S5.3 Generate a detailed risk description based on the operation and maintenance risk warning level and specific data of the anomaly dimension; S5.4. Develop corresponding handling recommendations for different risk levels and abnormal situations.

[0038] The system uses the multidimensional anomaly correlation threshold T=0.87 generated in Example 4 to determine the risk level according to the graded early warning rules. Since T>0.8, the system meets the condition that serious anomalies occur in all three dimensions at the same time, and triggers a high-risk early warning.

[0039] The system combines the warning level and specific data of the anomaly dimensions to generate a detailed risk description: "Abnormal operation detected: A teller processed 50% more transfer transactions than normal on the same day, the database server memory usage reached 92%, and the same IP address attempted to log in 8 times within 1 hour. There is a suspected risk of internal personnel violating regulations or the system being attacked." Furthermore, in response to this high-risk warning, the system automatically generates and executes the following handling recommendations: 1. Immediately freeze the teller's access permissions to prevent further escalation of the risk; 2. Conduct manual audits of relevant transactions to verify their authenticity and compliance; 3. Check the database server performance and optimize its configuration to improve system stability; 4. Isolate and audit abnormal IP addresses to identify potential security threats.

[0040] Furthermore, such as Figure 7 As shown, in order to execute the above-mentioned information system operation and maintenance risk warning method, this invention also discloses an information system operation and maintenance risk warning system, which is used to execute the above-mentioned information system operation and maintenance risk warning method, and specifically includes the following modules: The operation log correlation index generation module is used to generate operation log correlation indexes for execution S1; The data transmission integrity coefficient generation module is used to execute S2 to generate data transmission integrity coefficients; The multi-source data correlation matrix generation module is used to execute S3 to generate the multi-source data correlation matrix; The multidimensional anomaly correlation threshold generation module is used to execute S4 to generate multidimensional anomaly correlation thresholds; The module for generating operation and maintenance risk warning levels and handling suggestions is used to generate operation and maintenance risk warning levels and handling suggestions for S5.

[0041] Furthermore, to provide an operating environment for the information system operation and maintenance risk early warning system, the present invention also discloses an information system operation and maintenance risk early warning device, including a processor and a memory. The memory stores the aforementioned information system operation and maintenance risk early warning system, and the processor is used to run the aforementioned information system operation and maintenance risk early warning system.

[0042] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of this invention is defined by the appended claims and their equivalents.

Claims

1. A method for early warning of operational risks in information systems, characterized in that, Includes the following steps: S1. Collect user operation behavior data and generate operation log correlation indicators; S2. Based on the generated operation log correlation index, generate the data transmission integrity coefficient; S3. After obtaining the data transmission integrity coefficient, integrate the relevant data to generate a multi-source data correlation matrix; S4. Based on the multi-source data correlation matrix, set the multi-dimensional abnormal correlation threshold; S5. Based on the multidimensional anomaly correlation threshold, generate an operation and maintenance risk warning level and handling suggestions.

2. The information system operation and maintenance risk early warning method according to claim 1, characterized in that: S1 specifically includes the following steps in generating the correlation index of the operation log: S1.1 The system API interface collects operation behavior data in real time. The operation behavior data includes, but is not limited to, user login time, operation instruction type, operation object, and operation terminal IP address. The collected data is cleaned to remove duplicate and invalid data, and the valid data is selected for subsequent analysis. S1.2 Count the number of times each log field appears when the operation command is executed, and compare it with the system's preset baseline command log template to obtain the log field correlation value; The baseline instruction log template is generated based on the system's historical normal operation data and includes typical log field combinations corresponding to each instruction type.

3. The information system operation and maintenance risk early warning method according to claim 1, characterized in that: S2 specifically includes the following steps in generating the data transmission integrity coefficient: S2.1 Based on the correlation index of operation logs, the collected log data is divided into data blocks, and a hash operation is performed on each data block to obtain a hash value, thereby generating a data block hash value; S2.2 Obtain the current time as a timestamp, add the hash value and timestamp to the corresponding data block, organize the data blocks according to the blockchain chain structure, and generate chain data blocks; S2.3 At the receiving end, the data packets are checked in order according to the timestamp, the hash value of each data packet is recalculated, and the calculated hash value is compared with the hash value carried in the data packet. If the two hash values ​​are not equal, the receiving end is requested to retransmit the data packet. At the same time, network abnormalities are recorded, and a data transmission integrity coefficient is generated based on the hash value comparison result and the number of retransmissions.

4. The information system operation and maintenance risk early warning method according to claim 1, characterized in that: S3 specifically includes the following steps in generating the multi-source data correlation matrix: S3.

1. Call the data transmission integrity coefficient, integrate the feature values ​​of the user operation behavior associated log data with the feature values ​​of the system log data, and generate a user-system integrated feature value. S3.2 Integrate the user-system integrated feature value with the user behavior data feature value. Based on the analysis of user operation instructions, obtain the feature value of the instruction itself, the feature value of system log error information, and the feature value of user access frequency to generate multi-source integrated feature values. S3.3 Perform numerical comparisons and logical judgments on the consistency and differences of feature values ​​from different data sources, use cluster analysis to identify the association patterns between data, and generate multi-source data association moments based on the tightness of the association patterns.

5. The information system operation and maintenance risk early warning method according to claim 1, characterized in that: S4 specifically includes the following steps in generating the multidimensional anomaly correlation threshold: S4.

1. For the multi-source data correlation matrix, set the dimension of operation and maintenance instructions, combine the historical operation data of the information system and security policies, determine the abnormal operation judgment conditions, and generate operation and maintenance instruction abnormality indicators when an abnormality occurs in the dimension of operation and maintenance instructions. S4.

2. Retrieve the remaining memory value of the database server from the system performance indicator dimension, determine whether it is lower than 10%, and generate the system memory status value. S4.3 Retrieve user login records from the user behavior dimension, determine whether there are unauthorized users who have logged in more than a set number of times within a certain period of time, and generate user login anomaly values; S4.

4. Combine abnormal indicators of operation and maintenance commands, system memory status values, and abnormal user login values ​​to generate a multi-dimensional abnormal correlation threshold.

6. The information system operation and maintenance risk early warning method according to claim 1, characterized in that: S5 specifically includes the following steps in generating operational risk warning levels and providing handling recommendations: S5.

1. Based on the multidimensional anomaly correlation threshold, a graded early warning rule is adopted to determine the risk level: when three or more dimensions show serious anomalies at the same time, a high-risk warning is triggered. When one or two dimensions show moderate anomalies, a medium-risk warning is triggered. A low-risk warning is triggered when only a single dimension shows a slight anomaly. S5.

2. Based on the specific data of the early warning level and anomaly dimension, generate the operation and maintenance risk early warning level; S5.3 Generate a detailed risk description based on the operation and maintenance risk warning level and specific data of the anomaly dimension; S5.

4. Develop corresponding handling recommendations for different risk levels and abnormal situations.

7. The information system operation and maintenance risk early warning method according to claim 2, characterized in that: When collecting operation behavior data as described in S1.1, log data within 60 seconds before and after the instruction execution time is accurately extracted to count the frequency of operation instruction log fields.

8. The information system operation and maintenance risk early warning method according to claim 3, characterized in that: When generating chained data blocks as described in S2.2, in accordance with the requirements of the blockchain chain structure, it is ensured that each data packet accurately contains the hash value of the previous data packet.

9. An information system operation and maintenance risk early warning system, used to execute the information system operation and maintenance risk early warning method according to any one of claims 1-8, characterized in that, The system includes the following modules: The operation log correlation index generation module is used to generate the operation log correlation index as described in S1. The data transmission integrity coefficient generation module is used to perform the generation of data transmission integrity coefficients as described in S2. The multi-source data correlation matrix generation module is used to perform the generation of the multi-source data correlation matrix described in S3; The multidimensional anomaly correlation threshold generation module is used to perform the generation of multidimensional anomaly correlation thresholds as described in S4; The module for generating operation and maintenance risk warning levels and handling suggestions is used to perform the generation of operation and maintenance risk warning levels and handling suggestions as described in S5.

10. An information system operation and maintenance risk early warning device, comprising a processor and a memory, characterized in that: The memory stores the information system operation and maintenance risk warning system as described in claim 9, and the processor is used to run the information system operation and maintenance risk warning system as described in claim 9.

Images