Desktop state monitoring method, system and equipment and storage medium

Abstract

The invention discloses a desktop state monitoring method, system and device and a storage medium, and the desktop state monitoring method comprises the steps: building a first knowledge graph based on first desktop environment data, first user behavior data and first business process data, building an initial desktop state monitoring model, training the initial desktop state monitoring model based on the first desktop environment data, the first user behavior data and the first business process data to obtain a trained desktop state monitoring model and a desktop state prediction result; updating the first knowledge graph based on the desktop state prediction result to obtain a second knowledge graph; and based on the second desktop environment data, the second user behavior data and the second business process data, the desktop state monitoring result of the target user is determined through the trained desktop state monitoring model and the second knowledge graph, so that the real-time monitoring capability is improved, and the monitoring comprehensiveness is enhanced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of desktop state monitoring, and in particular to a desktop state monitoring method, system, device and storage medium. BACKGROUND

[0002] With the rapid development of information technology, desktop monitoring is increasingly important in the fields of network security, enterprise management and user behavior analysis.

[0003] Currently, the method for monitoring the state of the desktop has a delay in collection and analysis, and cannot reflect the dynamic changes of the desktop in a timely manner, making it difficult to respond to sudden security incidents or user behavior abnormalities. SUMMARY

[0004] The present application aims to at least solve the technical problems existing in the prior art. To this end, the present application provides a desktop state monitoring method, system, device and storage medium, which can improve real-time monitoring capability and enhance comprehensive monitoring.

[0005] In a first aspect of the present application, a desktop state monitoring method is provided, comprising the following steps:

[0006] Obtaining first desktop environment data, first user behavior data and first business process data of historical users, and second desktop environment data, second user behavior data and second business process data of a target user;

[0007] Based on the first desktop environment data, the first user behavior data and the first business process data, a first knowledge graph is constructed, wherein the first knowledge graph includes at least one of desktop entities, behavior entities, business entities, entity relationships, alarm categories and optimization strategies;

[0008] An initial desktop state monitoring model is constructed, and the initial desktop state monitoring model is trained based on the first desktop environment data, the first user behavior data and the first business process data to obtain a trained desktop state monitoring model and a desktop state prediction result;

[0009] The first knowledge graph is updated based on the desktop state prediction result to obtain a second knowledge graph;

[0010] Based on the second desktop environment data, the second user behavior data and the second business process data, the desktop state monitoring result of the target user is determined through the trained desktop state monitoring model and the second knowledge graph.

[0011] According to the control method of the present application, at least the following advantages are achieved:

[0012] The method comprises the following steps: acquiring first desktop environment data, first user behavior data, first business process data of a historical user, and second desktop environment data, second user behavior data and second business process data of a target user; constructing a first knowledge graph based on the first desktop environment data, the first user behavior data and the first business process data, wherein the first knowledge graph comprises at least one of a desktop entity, a behavior entity, a business entity, an entity relationship, an alarm category and an optimization strategy; the application integrates multi-dimensional monitoring data through the knowledge graph, constructs an initial desktop state monitoring model, trains the initial desktop state monitoring model based on the first desktop environment data, the first user behavior data and the first business process data, obtains a trained desktop state monitoring model and a desktop state prediction result, updates the first knowledge graph based on the desktop state prediction result, and obtains a second knowledge graph; the application realizes real-time monitoring of the desktop through the desktop state monitoring model, determines a desktop state monitoring result of the target user based on the second desktop environment data, the second user behavior data and the second business process data, the trained desktop state monitoring model and the second knowledge graph, and improves real-time monitoring capability and enhances monitoring comprehensiveness through combination of graph query and model monitoring.

[0013] According to some embodiments of the application, the desktop state monitoring result of the target user is determined based on the second desktop environment data, the second user behavior data and the second business process data, through the trained desktop state monitoring model and the second knowledge graph, comprising:

[0014] The second desktop environment data, the second user behavior data and the second business process data are input into the second knowledge graph to obtain a graph query result;

[0015] The second desktop environment data, the second user behavior data and the second business process data are input into the trained desktop state monitoring model to obtain a desktop state prediction result;

[0016] The graph query result and the desktop state prediction result are matched with a preset alarm rule to obtain the desktop state monitoring result of the target user.

[0017] According to some embodiments of the application, the desktop state monitoring method further comprises:

[0018] The desktop state monitoring result is matched with an optimization strategy in the second knowledge graph to obtain a matching result;

[0019] In the case that the matching result is empty, the desktop state monitoring result is input into the trained strategy generation model to obtain a first optimization strategy;

[0020] performing the first optimization strategy on the desktop of the target user, and updating a preset strategy index based on an execution result of the first optimization strategy;

[0021] optimizing the second knowledge graph based on the updated preset strategy index;

[0022] in a case where the matching result is not empty, performing the matching result on the desktop of the target user, and updating the preset strategy index based on an execution result of the matching result;

[0023] optimizing the second knowledge graph based on the updated preset strategy index.

[0024] According to some embodiments of the present application, the updating the first knowledge graph based on the desktop state prediction result to obtain a second knowledge graph comprises:

[0025] screening the desktop state prediction result based on a preset screening rule to obtain a screened prediction result;

[0026] updating the first knowledge graph based on the screened prediction result to obtain the second knowledge graph.

[0027] According to some embodiments of the present application, the training the initial desktop state monitoring model based on the first desktop environment data, the first user behavior data and the first business process data to obtain a trained desktop state monitoring model and a desktop state prediction result comprises:

[0028] inputting the first desktop environment data, the first user behavior data and the first business process data into the initial desktop state monitoring model to obtain a first loss value;

[0029] updating the initial desktop state monitoring model based on the first loss value until the loss value reaches a preset value or the number of training reaches a preset number to obtain the trained desktop state monitoring model and the desktop state prediction result.

[0030] According to some embodiments of the present application, the constructing a first knowledge graph based on the first desktop environment data, the first user behavior data and the first business process data comprises:

[0031] constructing the first knowledge graph based on the first desktop environment data, the first user behavior data and the first business process data by natural language technology.

[0032] According to some embodiments of the present application, the obtaining the first desktop environment data, the first user behavior data and the first business process data of the historical user comprises:

[0033] According to a preset rule, initial desktop environment data, initial user behavior data and initial business process data of a historical user are collected, the initial desktop environment data includes at least one of screen and window data, application data and hardware resource data, the initial user behavior data includes at least one of input operation data and data interaction data, and the initial business process data includes at least one of business association data and scene label data;

[0034] The initial desktop environment data is preprocessed to obtain the first desktop environment data, the initial user behavior data is preprocessed to obtain the first user behavior data, and the initial business process data is preprocessed to obtain the first business process data.

[0035] In a second aspect of the present application, a desktop state monitoring system is provided, and the desktop state monitoring system comprises:

[0036] A data acquisition module is configured to acquire first desktop environment data, first user behavior data, first business process data of a historical user, and second desktop environment data, second user behavior data and second business process data of a target user.

[0037] A graph construction module is configured to construct a first knowledge graph based on the first desktop environment data, the first user behavior data and the first business process data, wherein the first knowledge graph includes at least one of desktop entities, behavior entities, business entities, entity relationships, alarm categories and optimization strategies.

[0038] A model training module is configured to construct an initial desktop state monitoring model, train the initial desktop state monitoring model based on the first desktop environment data, the first user behavior data and the first business process data, and obtain a trained desktop state monitoring model and a desktop state prediction result.

[0039] A graph updating module is configured to update the first knowledge graph based on the desktop state prediction result to obtain a second knowledge graph.

[0040] A result determination module is configured to determine a desktop state monitoring result of the target user based on the second desktop environment data, the second user behavior data and the second business process data, the trained desktop state monitoring model and the second knowledge graph.

[0041] The system obtains first desktop environment data, first user behavior data, first business process data of historical users, and second desktop environment data, second user behavior data and second business process data of a target user; based on the first desktop environment data, the first user behavior data and the first business process data, a first knowledge graph is constructed, wherein the first knowledge graph includes at least one of a desktop entity, a behavior entity, a business entity, an entity relationship, an alarm category and an optimization strategy; the application integrates multi-dimensional monitoring data through the knowledge graph, constructs an initial desktop state monitoring model, trains the initial desktop state monitoring model based on the first desktop environment data, the first user behavior data and the first business process data, obtains a trained desktop state monitoring model and a desktop state prediction result; the first knowledge graph is updated based on the desktop state prediction result to obtain a second knowledge graph; the application realizes real-time monitoring of the desktop through the desktop state monitoring model, determines a desktop state monitoring result of the target user based on the second desktop environment data, the second user behavior data and the second business process data, the trained desktop state monitoring model and the second knowledge graph, and improves real-time monitoring capability and enhances monitoring comprehensiveness through combination of graph query and model monitoring.

[0042] In a third aspect, the application provides a desktop state monitoring electronic device, including at least one control processor and a memory connected in communication with the at least one control processor; the memory stores instructions executable by the at least one control processor, and the instructions are executed by the at least one control processor to enable the at least one control processor to execute the desktop state monitoring method described above.

[0043] In a fourth aspect, the application provides a computer-readable storage medium storing computer-executable instructions for causing a computer to execute the desktop state monitoring method described above.

[0044] It should be noted that the beneficial effects of the second aspect to the fourth aspect of the application and the prior art are the same as those of the desktop state monitoring system described above and the prior art, which will not be described here.

[0045] Additional aspects and advantages of the application will be in part apparent and in part pointed out hereinafter. BRIEF DESCRIPTION OF DRAWINGS

[0046] The above and / or additional aspects and advantages of the application will become apparent and be readily appreciated from the following description, including the appended drawings, wherein:

[0047] Figure 1 is a flowchart of a desktop state monitoring method according to an embodiment of the application;

[0048] Figure 2 is a structural schematic diagram of an embodiment of a desktop state monitoring system provided by the present application;

[0049] Figure 3 is a structural schematic diagram of an embodiment of an electronic device provided by the present application. DETAILED DESCRIPTION

[0050] Embodiments of the present application will be described in detail below, examples of the embodiments being shown in the drawings, in which the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below by referring to the drawings are exemplary and are only used to explain the present application and cannot be understood as limiting the present application.

[0051] In the description of the present application, if there is a description of first, second, etc., it is only for the purpose of distinguishing technical features, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of indicated technical features or the sequence of indicated technical features.

[0052] In the description of the present application, it should be understood that the orientation description, such as up, down, etc., indicates the orientation or positional relationship based on the orientation or positional relationship shown in the drawings, which is only for the convenience of describing the present application and simplifying the description, and does not indicate or imply that the device or element referred to must have a particular orientation, be constructed and operated in a particular orientation, and therefore cannot be understood as limiting the present application.

[0053] In the description of the present application, it should be noted that, unless otherwise explicitly limited, the words such as setting, installing, connecting, etc. should be broadly understood, and those skilled in the art can reasonably determine the specific meaning of the above words in the present application in combination with the specific content of the technical solution.

[0054] With the rapid development of information technology, desktop monitoring is increasingly important in the fields of network security, enterprise management and user behavior analysis.

[0055] At present, the method for monitoring the desktop state has a delay in collection and analysis, and cannot reflect the dynamic changes of the desktop in a timely manner, making it difficult to deal with sudden security incidents or user behavior abnormalities.

[0056] In order to solve the above technical defects, the embodiments of the present application provide a desktop state monitoring method, system, device and storage medium.

[0057] Please refer to Figure 1 is a flowchart of a desktop state monitoring method provided by an embodiment of the present application, which is applied to an electronic device, which can be a server or the like. As shown in Figure 1 The desktop state monitoring method comprises the following steps.

[0058] Step S101, obtaining first desktop environment data, first user behavior data, first business process data of historical users, and second desktop environment data, second user behavior data and second business process data of a target user;

[0059] Step S102, constructing a first knowledge graph based on the first desktop environment data, the first user behavior data and the first business process data, wherein the first knowledge graph comprises at least one of desktop entities, behavior entities, business entities, entity relationships, alarm categories and optimization strategies;

[0060] Step S103, constructing an initial desktop state monitoring model, training the initial desktop state monitoring model based on the first desktop environment data, the first user behavior data and the first business process data to obtain a trained desktop state monitoring model and a desktop state prediction result;

[0061] Step S104, updating the first knowledge graph based on the desktop state prediction result to obtain a second knowledge graph;

[0062] Step S105, determining a desktop state monitoring result of the target user based on the second desktop environment data, the second user behavior data and the second business process data, the trained desktop state monitoring model and the second knowledge graph.

[0063] The method obtains first desktop environment data, first user behavior data, first business process data of historical users, and second desktop environment data, second user behavior data and second business process data of a target user; constructs a first knowledge graph based on the first desktop environment data, the first user behavior data and the first business process data, wherein the first knowledge graph comprises at least one of desktop entities, behavior entities, business entities, entity relationships, alarm categories and optimization strategies; the application integrates multi-dimensional monitoring data through the knowledge graph, constructs an initial desktop state monitoring model, trains the initial desktop state monitoring model based on the first desktop environment data, the first user behavior data and the first business process data to obtain a trained desktop state monitoring model and a desktop state prediction result; updates the first knowledge graph based on the desktop state prediction result to obtain a second knowledge graph; the application realizes real-time monitoring of the desktop through the desktop state monitoring model, determines a desktop state monitoring result of the target user based on the second desktop environment data, the second user behavior data and the second business process data, the trained desktop state monitoring model and the second knowledge graph; the application improves real-time monitoring capability and enhances monitoring comprehensiveness by combining graph query and model monitoring.

[0064] In some embodiments, based on the second desktop environment data, the second user behavior data and the second business process data, the desktop state monitoring result of the target user is determined through the trained desktop state monitoring model and the second knowledge graph, including:

[0065] In step S201, the second desktop environment data, the second user behavior data and the second business process data are input into the second knowledge graph to obtain a graph query result.

[0066] In step S202, the second desktop environment data, the second user behavior data and the second business process data are input into the trained desktop state monitoring model to obtain a desktop state prediction result.

[0067] In step S203, the graph query result and the desktop state prediction result are matched with a preset alarm rule to obtain the desktop state monitoring result of the target user.

[0068] In some embodiments, the graph query result can be a type of unsafe operation existing on the desktop.

[0069] The desktop state prediction result can be a type of predicted unsafe operation existing on the desktop.

[0070] The preset alarm rule can be that the graph query result and the desktop state prediction result both exist in the same type of unsafe operation existing on the desktop.

[0071] In some embodiments, the desktop state monitoring method further includes:

[0072] In step S301, the desktop state monitoring result is matched with an optimization strategy in the second knowledge graph to obtain a matching result.

[0073] In step S302, in a case where the matching result is empty, the desktop state monitoring result is input into the trained strategy generation model to obtain a first optimization strategy.

[0074] In step S304, the first optimization strategy is executed on the desktop of the target user, and a preset strategy indicator is updated based on an execution result of the first optimization strategy.

[0075] In step S305, the second knowledge graph is optimized based on the updated preset strategy indicator.

[0076] In step S306, in a case where the matching result is not empty, the matching result is executed on the desktop of the target user, and a preset strategy indicator is updated based on an execution result of the matching result.

[0077] In step S307, the second knowledge graph is optimized based on the updated preset strategy indicator.

[0078] Specifically, in some embodiments, the similarity of different business scenarios is analyzed by a graph neural network (GNN), and a policy template of a certain scenario is migrated to a similar scenario, for example, a "research system code submission" policy is migrated to a "design file upload" scenario. The similarity calculation uses a graph edit distance algorithm, and the threshold is set to 0.7.

[0079] Specifically, the above-mentioned updating of the preset policy index can be predicting a risk probability by a large model for a scene without clear rules (such as a new operation mode), and generating a temporary policy (such as temporarily increasing the monitoring frequency) when the threshold (such as 70%) is exceeded. It can also be using a reinforcement learning (RL) algorithm to optimize policy parameters, such as alarm thresholds. Taking the "CPU occupancy alarm" policy as an example, the threshold is adjusted by the PPO algorithm, and the goal is to make the false positive rate less than 5% and the false negative rate less than 1%. It can also generate a preventive policy (such as releasing the cache in advance) when the large model predicts a potential risk trend (such as a memory leak probability greater than 80% in the next 2 hours).

[0080] In some embodiments, the first knowledge graph is updated based on the desktop state prediction result to obtain a second knowledge graph, including:

[0081] Step S401, filtering the desktop state prediction result based on a preset filtering rule to obtain a filtered prediction result;

[0082] Step S402, updating the first knowledge graph based on the filtered prediction result to obtain a second knowledge graph.

[0083] Specifically, the above-mentioned preset filtering rule can be that the confidence value of the desktop state prediction result needs to be greater than 80% to be considered satisfactory.

[0084] In some embodiments, the initial desktop state monitoring model is trained based on the first desktop environment data, the first user behavior data and the first business process data to obtain a trained desktop state monitoring model and a desktop state prediction result, including:

[0085] Step S501, inputting the first desktop environment data, the first user behavior data and the first business process data into the initial desktop state monitoring model to obtain a first loss value;

[0086] Step S502, updating the initial desktop state monitoring model based on the first loss value until the loss value reaches a preset value or the number of training reaches a preset number of times, to obtain a trained desktop state monitoring model and a desktop state prediction result.

[0087] Specifically, potential failures can be warned in advance through the prediction ability of the large model. For example, when it is predicted that a certain server hard disk is about to fail, the spare parts scheduling process is automatically triggered.

[0088] In some embodiments, based on the first desktop environment data, the first user behavior data, and the first business process data, a first knowledge graph is constructed, including:

[0089] Step S601, based on the first desktop environment data, the first user behavior data, and the first business process data, a first knowledge graph is constructed by natural language technology.

[0090] Specifically, in some embodiments, the first knowledge graph can be constructed to model policy metadata: define policy entities in the knowledge graph, including policy ID, type (alert, block, and optimize), trigger condition, execution action, and other attributes, and connect to related entities through relationships (such as Policy.appliesTo.Application indicating that the policy applies to an application). Scene-policy mapping: construct a "business scene-risk type-policy template" triple relationship, for example, the "financial system operation" scene is connected to the "sensitive data leakage" risk through relatesTo.RiskType, and then associated with the corresponding monitoring policy template through requires.PolicyTemplate.

[0091] In some embodiments, the first desktop environment data, the first user behavior data, and the first business process data of the historical user are obtained, including:

[0092] Step S701, according to a preset rule, initial desktop environment data, initial user behavior data, and initial business process data of a historical user are collected, the initial desktop environment data includes at least one of screen and window data, application program data, and hardware resource data, the initial user behavior data includes at least one of input operation data and data interaction data, and the initial business process data includes at least one of business association data and scene label data;

[0093] Step S702, the initial desktop environment data is preprocessed to obtain the first desktop environment data; the initial user behavior data is preprocessed to obtain the first user behavior data; and the initial business process data is preprocessed to obtain the first business process data.

[0094] Specifically, the screen and window data can be data of desktop screen pictures, window opening or closing states, window level relationships, and window content changes, which are used to monitor the desktop visual state and operation interface dynamics.

[0095] The application program data can be data of a list of running application programs, process information (such as PID, CPU / memory occupation), application program versions, and window titles and interaction states.

[0096] The hardware resource data can be CPU usage, memory usage, disk read / write speed, network traffic (upload or download speed, connection number), and GPU usage.

[0097] The input operation data can be recording keyboard key sequence (including timestamp, combination key), mouse movement track, click position (left key, right key, scroll wheel operation), and click frequency.

[0098] The data interaction data can be monitoring clipboard content (text, file path), file operation (creation, modification, deletion, copying, pasting file and path), and external device (U disk, mobile hard disk) plug-in record.

[0099] The business association data can be business system interface data related to desktop operation, business process node state (such as order creation, data submission, and other key steps), and business data interaction content (such as form filling, data query parameters).

[0100] The scene label data can be the business scene (such as financial approval, customer service, and code development) and the operation purpose (such as data entry, file editing, and system configuration) to which the current operation belongs.

[0101] The preset rules can be dynamic collection frequency control rules and collection priority management rules.

[0102] The dynamic collection frequency control rules can be that the screen collection frequency is set to 5-10 frames per second in a regular scene, the hardware resource collection interval is 1-5 seconds, and the user behavior operation is captured in real time; when the CPU usage is greater than 80% or the memory usage is greater than 90%, the hardware resource collection frequency is automatically increased to 500ms per time, and the screen collection is switched to key frame capture; at the key steps of the business process (such as data submission and sensitive file access), the full-amount screen recording and high-frequency operation record are temporarily started to ensure data integrity.

[0103] The collection priority management rules can be that in the core data, the user keyboard or mouse operation, sensitive file access record, and business process key node data are set to the highest priority to ensure real-time transmission and storage; in the auxiliary data, the hardware resource index and non-sensitive window state are set to medium priority, and batch transmission is adopted (such as packaging once every 10 seconds); in the redundant data, the non-active window picture and the list of regular application programs are set to low priority, and can be collected with delay or suspended when resources are tight.

[0104] The preprocessing includes denoising, data association and labeling, and data compression and caching.

[0105] In addition, with reference to Figure 2In an embodiment of the present application, a desktop state monitoring system is provided, comprising a data acquisition module 1100, a graph construction module 1200, a model training module 1300, a graph updating module 1400, and a result determination module 1500, wherein:

[0106] The data acquisition module 1100 is configured to acquire first desktop environment data, first user behavior data, and first business process data of a historical user, and second desktop environment data, second user behavior data, and second business process data of a target user;

[0107] The graph construction module 1200 is configured to construct a first knowledge graph based on the first desktop environment data, the first user behavior data, and the first business process data, wherein the first knowledge graph comprises at least one of a desktop entity, a behavior entity, a business entity, an entity relationship, an alarm category, and an optimization strategy;

[0108] The model training module 1300 is configured to construct an initial desktop state monitoring model, train the initial desktop state monitoring model based on the first desktop environment data, the first user behavior data, and the first business process data, obtain a trained desktop state monitoring model, and obtain a desktop state prediction result;

[0109] The graph updating module 1400 is configured to update the first knowledge graph based on the desktop state prediction result to obtain a second knowledge graph;

[0110] The result determination module 1500 is configured to determine a desktop state monitoring result of the target user based on the second desktop environment data, the second user behavior data, and the second business process data, the trained desktop state monitoring model, and the second knowledge graph.

[0111] The system obtains first desktop environment data, first user behavior data, first business process data of historical users, and second desktop environment data, second user behavior data and second business process data of a target user; based on the first desktop environment data, the first user behavior data and the first business process data, a first knowledge graph is constructed, wherein the first knowledge graph includes at least one of a desktop entity, a behavior entity, a business entity, an entity relationship, an alarm category and an optimization strategy; the application integrates multi-dimensional monitoring data through the knowledge graph, constructs an initial desktop state monitoring model, trains the initial desktop state monitoring model based on the first desktop environment data, the first user behavior data and the first business process data, obtains a trained desktop state monitoring model and a desktop state prediction result; the first knowledge graph is updated based on the desktop state prediction result to obtain a second knowledge graph; the application realizes real-time monitoring of the desktop through the desktop state monitoring model, determines a desktop state monitoring result of the target user based on the second desktop environment data, the second user behavior data and the second business process data, the trained desktop state monitoring model and the second knowledge graph, and improves real-time monitoring capability and enhances monitoring comprehensiveness through combination of graph query and model monitoring.

[0112] It should be noted that the system embodiment and the method embodiment described above are based on the same inventive concept, so the related content of the method embodiment described above is also applicable to the system embodiment, which will not be described here.

[0113] Figure 3 A rule mining hardware structure schematic diagram provided by an embodiment of the application is shown.

[0114] The desktop state monitoring device can include a processor 301 and a memory 302 storing computer program instructions.

[0115] Specifically, the processor 301 described above can include a central processing unit (CPU), or a specific integrated circuit (Application Specific Integrated Circuit, ASIC), or can be configured as one or more integrated circuits that implement one or more embodiments of the application.

[0116] The memory 302 can include mass storage for data or instructions. As an example and not by way of limitation, the memory 302 can include a hard disk drive (HDD), a floppy disk drive, flash memory, an optical disc (e.g., a compact disc (CD) or a digital versatile disc (DVD)), a solid-state drive (SSD), a USB drive, or a combination of two or more of these. Where appropriate, the memory 302 can include removable or non-removable (or fixed) media, where appropriate. The memory 302 can be internal or external to the integrated gateway disaster recovery appliance. In particular embodiments, the memory 302 is non-volatile, solid-state memory.

[0117] In some embodiments, the memory 302 can include read-only memory (ROM), random-access memory (RAM), a disk storage medium device, an optical storage medium device, a flash memory device, an electrical, optical, or other physical / tangible memory storage device. Thus, generally, the memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., a memory device) encoded with software that, when executed (e.g., by the one or more processors), is operable to perform the operations described with reference to the methods according to an aspect of the present disclosure.

[0118] The processor 301 implements any one of the desktop state monitoring methods in the above embodiments by reading and executing computer program instructions stored in the memory 302.

[0119] In one example, the desktop state monitoring device can further include a communication interface 303 and a bus 310. Wherein, as shown in the figure, the processor 301, the memory 302, the communication interface 303 are connected through the bus 310 and complete the communication between each other. Figure 3

[0120] The communication interface 303 is mainly used to realize the communication between each module, device, unit and / or equipment in the embodiments of the present application.

[0121] ​Bus 310 includes a hardware, software, or both that couples components of the desktop state monitoring device to each other. As an example and not by way of limitation, the bus can include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a HyperTransport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an InfiniBand (IB) interconnect, a Low Pin Count (LPC) bus, a memory bus, a Micro Channel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association local (VLB) bus, or another suitable bus or a combination of two or more of these. Where appropriate, bus 310 can include one or more buses. Although this application describes and shows a particular bus, this application contemplates any suitable bus or interconnect.

[0122] The desktop state monitoring device can perform the desktop state monitoring method in this application based on the three-dimensional design model, thereby realizing the desktop state monitoring method and system described in combination Figure 1 and Figure 2 with the above embodiments.

[0123] In addition, in combination with the desktop state monitoring method in the above embodiments, the embodiments of this application can provide a computer storage medium to realize. The computer storage medium has computer program instructions stored thereon; the computer program instructions are executed by a processor to realize any one of the desktop state monitoring methods in the above embodiments.

[0124] It needs to be clear that this application is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of this application is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between steps, after understanding the spirit of this application.

[0125] The functional blocks shown in the structural block diagrams above can be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, and the like. When implemented in software, the elements of the present application are program or code segments that are used to perform the required tasks. The program or code segments can be stored in a machine-readable medium, or transmitted through a data signal carried in a carrier wave over a transmission medium or communication link. A "machine-readable medium" includes any medium that can store or transport information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROMs, flash memories, erasable ROMs (EROMs), floppy disks, CD-ROMs, optical disks, hard disks, fiber optic media, radio frequency (RF) links, and the like. The code segments can be downloaded via computer networks such as the Internet, intranets, and the like.

[0126] It is also important to note that the examples mentioned in the present application describe some methods or systems based on a series of steps or devices. However, the present application is not limited to the order of the steps mentioned above, that is, the steps can be performed in the order mentioned in the examples, or in an order different from the examples, or several steps can be performed simultaneously.

[0127] The computer program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other processing devices to cause a series of operational steps to be performed on the computer, other programmable apparatus or other processing devices to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks. These computer program instructions can also be stored in a computer readable medium that can direct a computer, other programmable data processing apparatus, or other processing devices to operate in a particular manner, such that the instructions stored in the computer readable medium produce an article of manufacture including instructions which implement the function / act specified in the flowchart and / or block diagram block or blocks. The computer program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other processing devices to cause a series of operational steps to be performed on the computer, other programmable apparatus or other processing devices to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks. These computer program instructions can also be stored in a computer readable medium that can direct a computer, other programmable data processing apparatus, or other processing devices to operate in a particular manner, such that the instructions stored in the computer readable medium produce an article of manufacture including instructions which implement the function / act specified in the flowchart and / or block diagram block or blocks.

[0128] The above merely describes a specific implementation of the present application. Those skilled in the art can clearly understand the specific working processes of the system, modules and units described above for the convenience and brevity of description, and can refer to the corresponding processes in the foregoing method embodiments, which will not be described herein again. It should be understood that the protection scope of the present application is not limited to this, and any person skilled in the art can easily think of various equivalent modifications or replacements within the technical range disclosed by the present application, and these modifications or replacements should be covered within the protection scope of the present application.

Claims

1. A method of desktop state monitoring, characterized by, The desktop state monitoring method comprises: obtaining first desktop environment data, first user behavior data, first business process data of historical users, and second desktop environment data, second user behavior data and second business process data of a target user; constructing a first knowledge graph based on the first desktop environment data, the first user behavior data and the first business process data, wherein the first knowledge graph comprises at least one of desktop entities, behavior entities, business entities, entity relationships, alarm categories and optimization strategies; constructing an initial desktop state monitoring model, training the initial desktop state monitoring model based on the first desktop environment data, the first user behavior data and the first business process data, obtaining a trained desktop state monitoring model and a desktop state prediction result; updating the first knowledge graph based on the desktop state prediction result to obtain a second knowledge graph; determining a desktop state monitoring result of the target user based on the second desktop environment data, the second user behavior data and the second business process data, the trained desktop state monitoring model and the second knowledge graph.

2. The method of claim 1, wherein, The method comprises: inputting the second desktop environment data, the second user behavior data and the second business process data into the second knowledge graph to obtain a graph query result; inputting the second desktop environment data, the second user behavior data and the second business process data into the trained desktop state monitoring model to obtain a desktop state prediction result; matching the graph query result and the desktop state prediction result with a preset alarm rule to obtain the desktop state monitoring result of the target user.

3. The method of claim 1, wherein, The desktop state monitoring method further comprises: matching the desktop state monitoring result with an optimization strategy in the second knowledge graph to obtain a matching result; in the case that the matching result is empty, inputting the desktop state monitoring result into the trained strategy generation model to obtain a first optimization strategy; executing the first optimization strategy on the desktop of the target user, and updating a preset strategy indicator based on the execution result of the first optimization strategy; optimizing the second knowledge graph based on the updated preset strategy indicator; in the case that the matching result is not empty, executing the matching result on the desktop of the target user, and updating the preset strategy indicator based on the execution result of the matching result; optimizing the second knowledge graph based on the updated preset strategy indicator.

4. The method of claim 1, wherein, The method comprises: screening the desktop state prediction result based on a preset screening rule to obtain a screened prediction result; updating the first knowledge graph based on the screened prediction result to obtain the second knowledge graph.

5. The method of claim 2, wherein, The initial desktop state monitoring model is trained based on the first desktop environment data, the first user behavior data and the first business process data to obtain a trained desktop state monitoring model and a desktop state prediction result, including: The first desktop environment data, the first user behavior data and the first business process data are input into the initial desktop state monitoring model to obtain a first loss value; The initial desktop state monitoring model is updated based on the first loss value until the loss value reaches a preset value or the number of training reaches a preset number, to obtain the trained desktop state monitoring model and the desktop state prediction result.

6. The method of claim 2, wherein, The first knowledge graph is constructed based on the first desktop environment data, the first user behavior data and the first business process data, including: The first knowledge graph is constructed by natural language technology based on the first desktop environment data, the first user behavior data and the first business process data.

7. The method of claim 1, wherein, The first desktop environment data, the first user behavior data and the first business process data of the historical user are obtained, including: The initial desktop environment data, the initial user behavior data and the initial business process data of the historical user are collected according to a preset rule, the initial desktop environment data includes at least one of screen and window data, application program data and hardware resource data, the initial user behavior data includes at least one of input operation data and data interaction data, and the initial business process data includes at least one of business association data and scene label data; The initial desktop environment data is preprocessed to obtain the first desktop environment data, the initial user behavior data is preprocessed to obtain the first user behavior data, and the initial business process data is preprocessed to obtain the first business process data.

8. A desktop state monitoring system, characterized by The desktop state monitoring system includes: A data acquisition module is configured to acquire first desktop environment data, first user behavior data and first business process data of a historical user, and second desktop environment data, second user behavior data and second business process data of a target user; A graph construction module is configured to construct a first knowledge graph based on the first desktop environment data, the first user behavior data and the first business process data, wherein the first knowledge graph includes at least one of desktop entities, behavior entities, business entities, entity relationships, alarm categories and optimization strategies; A model training module is configured to construct an initial desktop state monitoring model, train the initial desktop state monitoring model based on the first desktop environment data, the first user behavior data and the first business process data, and obtain a trained desktop state monitoring model and a desktop state prediction result; A graph updating module is configured to update the first knowledge graph based on the desktop state prediction result to obtain a second knowledge graph; A result determination module is configured to determine a desktop state monitoring result of the target user based on the second desktop environment data, the second user behavior data and the second business process data, the trained desktop state monitoring model and the second knowledge graph.

9. A desktop state monitoring device, characterized by comprising at least one control processor and a memory communicatively connected to the at least one control processor; the memory storing instructions executable by the at least one control processor, the instructions being executed by the at least one control processor to enable the at least one control processor to perform a method of monitoring a state of a desktop as claimed in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer readable storage medium stores computer executable instructions for causing a computer to perform a method of monitoring a state of a desktop as claimed in any one of claims 1 to 7.

Images