A desktop state monitoring method, system, device and storage medium

Abstract

The application discloses a desktop state monitoring method, system, device and storage medium. The desktop state monitoring method comprises the following steps: constructing a first knowledge graph based on first desktop environment data, first user behavior data and first business process data; constructing an initial desktop state monitoring model; training the initial desktop state monitoring model based on the first desktop environment data, the first user behavior data and the first business process data, to obtain a trained desktop state monitoring model and a desktop state prediction result; updating the first knowledge graph based on the desktop state prediction result, to obtain a second knowledge graph; and determining a desktop state monitoring result of a target user based on second desktop environment data, second user behavior data and second business process data, through the trained desktop state monitoring model and the second knowledge graph. The real-time monitoring capability is improved, and the monitoring comprehensiveness is enhanced.

Description

Technical Field

[0001] This application relates to the technical field of desktop status monitoring, and in particular to a desktop status monitoring method, system, device and storage medium. Background Technology

[0002] With the rapid development of information technology, desktop monitoring is becoming increasingly important in areas such as network security, enterprise management, and user behavior analysis.

[0003] Currently, methods for monitoring desktop status suffer from delays in data collection and analysis, failing to reflect dynamic changes in the desktop in a timely manner and making it difficult to respond to sudden security incidents or abnormal user behavior. Summary of the Invention

[0004] This application aims to at least address the technical problems existing in the prior art. To this end, this application proposes a desktop status monitoring method, system, device, and storage medium, which can improve real-time monitoring capabilities and enhance the comprehensiveness of monitoring.

[0005] The first aspect of this application provides a desktop status monitoring method, comprising the following steps:

[0006] Acquire the first desktop environment data, first user behavior data, and first business process data of historical users, and the second desktop environment data, second user behavior data, and second business process data of target users;

[0007] Based on the first desktop environment data, the first user behavior data, and the first business process data, a first knowledge graph is constructed, wherein the first knowledge graph includes at least one of desktop entities, behavior entities, business entities, entity relationships, alarm categories, and optimization strategies;

[0008] An initial desktop status monitoring model is constructed, and the initial desktop status monitoring model is trained based on the first desktop environment data, the first user behavior data, and the first business process data to obtain the trained desktop status monitoring model and desktop status prediction results.

[0009] The first knowledge graph is updated based on the desktop state prediction results to obtain the second knowledge graph;

[0010] Based on the second desktop environment data, the second user behavior data, and the second business process data, the desktop status monitoring results of the target user are determined through the trained desktop status monitoring model and the second knowledge graph.

[0011] The control method according to the embodiments of this application has at least the following beneficial effects:

[0012] This method acquires first desktop environment data, first user behavior data, and first business process data of historical users, and second desktop environment data, second user behavior data, and second business process data of the target user. Based on the first desktop environment data, first user behavior data, and first business process data, a first knowledge graph is constructed, wherein the first knowledge graph includes at least one of desktop entities, behavior entities, business entities, entity relationships, alarm categories, and optimization strategies. This application integrates multi-dimensional monitoring data through the knowledge graph to construct an initial desktop status monitoring model. The initial desktop status monitoring model is trained based on the first desktop environment data, first user behavior data, and first business process data to obtain a trained desktop status monitoring model and desktop status prediction results. The first knowledge graph is updated based on the desktop status prediction results to obtain a second knowledge graph. This application achieves real-time monitoring of the desktop through prediction using the desktop status monitoring model. Based on the second desktop environment data, second user behavior data, and second business process data, the desktop status monitoring results of the target user are determined through the trained desktop status monitoring model and the second knowledge graph. This application improves real-time monitoring capabilities and enhances monitoring comprehensiveness by combining graph query and model monitoring.

[0013] According to some embodiments of this application, determining the desktop status monitoring result of the target user based on the second desktop environment data, the second user behavior data, and the second business process data, through the trained desktop status monitoring model and the second knowledge graph, includes:

[0014] Input the second desktop environment data, the second user behavior data, and the second business process data into the second knowledge graph to obtain the graph query results;

[0015] Input the second desktop environment data, the second user behavior data, and the second business process data into the trained desktop status monitoring model to obtain desktop status prediction results;

[0016] The graph query results and the desktop status prediction results are matched with preset alarm rules to obtain the desktop status monitoring results of the target user.

[0017] According to some embodiments of this application, the desktop status monitoring method further includes:

[0018] The desktop status monitoring results are matched with the optimization strategies in the second knowledge graph to obtain the matching results;

[0019] If the matching result is empty, the desktop status monitoring result is input into the trained policy generation model to obtain the first optimized policy;

[0020] The first optimization strategy is executed on the target user's desktop, and the preset strategy indicators are updated based on the execution result of the first optimization strategy.

[0021] The second knowledge graph is optimized based on the updated preset strategy indicators;

[0022] If the matching result is not empty, the matching result is executed on the target user's desktop, and the preset strategy indicator is updated based on the execution result of the matching result;

[0023] The second knowledge graph is optimized based on the updated preset strategy metrics.

[0024] According to some embodiments of this application, updating the first knowledge graph based on the desktop state prediction result to obtain the second knowledge graph includes:

[0025] The desktop state prediction results are filtered based on preset filtering rules to obtain filtered prediction results.

[0026] The first knowledge graph is updated based on the prediction results after filtering to obtain the second knowledge graph.

[0027] According to some embodiments of this application, the step of training the initial desktop state monitoring model based on the first desktop environment data, the first user behavior data, and the first business process data to obtain a trained desktop state monitoring model and desktop state prediction results includes:

[0028] The first desktop environment data, the first user behavior data, and the first business process data are input into the initial desktop state monitoring model to obtain the first loss value;

[0029] The initial desktop status monitoring model is updated based on the first loss value until the loss value reaches a preset value or the number of training iterations reaches a preset number, thereby obtaining the trained desktop status monitoring model and the desktop status prediction result.

[0030] According to some embodiments of this application, constructing a first knowledge graph based on the first desktop environment data, the first user behavior data, and the first business process data includes:

[0031] The first knowledge graph is constructed using natural language processing based on the first desktop environment data, the first user behavior data, and the first business process data.

[0032] According to some embodiments of this application, the acquisition of historical user's first desktop environment data, first user behavior data, and first business process data includes:

[0033] The initial desktop environment data, initial user behavior data, and initial business process data of historical users are collected according to preset rules. The initial desktop environment data includes at least one of screen and window data, application data, and hardware resource data. The initial user behavior data includes at least one of input operation data and data interaction data. The initial business process data includes at least one of business association data and scene tag data.

[0034] The initial desktop environment data is preprocessed to obtain the first desktop environment data; the initial user behavior data is preprocessed to obtain the first user behavior data; and the initial business process data is preprocessed to obtain the first business process data.

[0035] A second aspect of this application provides a desktop status monitoring system, the desktop status monitoring system comprising:

[0036] The data acquisition module is used to acquire the first desktop environment data, first user behavior data, and first business process data of historical users, and the second desktop environment data, second user behavior data, and second business process data of target users.

[0037] The graph construction module is used to construct a first knowledge graph based on the first desktop environment data, the first user behavior data, and the first business process data. The first knowledge graph includes at least one of desktop entities, behavior entities, business entities, entity relationships, alarm categories, and optimization strategies.

[0038] The model training module is used to build an initial desktop status monitoring model. Based on the first desktop environment data, the first user behavior data, and the first business process data, the initial desktop status monitoring model is trained to obtain the trained desktop status monitoring model and desktop status prediction results.

[0039] The knowledge graph update module is used to update the first knowledge graph based on the desktop state prediction result to obtain the second knowledge graph.

[0040] The result determination module is used to determine the desktop status monitoring result of the target user based on the second desktop environment data, the second user behavior data, and the second business process data, through the trained desktop status monitoring model and the second knowledge graph.

[0041] This system acquires historical user desktop environment data, user behavior data, and business process data, as well as target user desktop environment data, user behavior data, and business process data. Based on the first desktop environment data, user behavior data, and business process data, a first knowledge graph is constructed, which includes at least one of desktop entities, behavior entities, business entities, entity relationships, alarm categories, and optimization strategies. This application integrates multi-dimensional monitoring data through the knowledge graph to construct an initial desktop status monitoring model. The initial desktop status monitoring model is trained based on the first desktop environment data, user behavior data, and business process data to obtain a trained desktop status monitoring model and desktop status prediction results. The first knowledge graph is updated based on the desktop status prediction results to obtain a second knowledge graph. This application achieves real-time desktop monitoring through prediction using the desktop status monitoring model. Based on the second desktop environment data, user behavior data, and business process data, the desktop status monitoring results for the target user are determined through the trained desktop status monitoring model and the second knowledge graph. By combining graph query and model monitoring, this application improves real-time monitoring capabilities and enhances monitoring comprehensiveness.

[0042] A third aspect of this application provides a desktop status monitoring electronic device, including at least one control processor and a memory for communicatively connecting to the at least one control processor; the memory stores instructions executable by the at least one control processor, which are executed by the at least one control processor to enable the at least one control processor to perform the desktop status monitoring method described above.

[0043] A fourth aspect of this application provides a computer-readable storage medium storing computer-executable instructions for causing a computer to perform the aforementioned desktop status monitoring method.

[0044] It should be noted that the beneficial effects of the second to fourth aspects of this application with respect to the prior art are the same as the beneficial effects of the desktop status monitoring system described above with respect to the prior art, and will not be described in detail here.

[0045] Additional aspects and advantages of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this application. Attached Figure Description

[0046] The above and / or additional aspects and advantages of this application will become apparent and readily understood from the description of the embodiments taken in conjunction with the following drawings, in which:

[0047] Figure 1 This is a flowchart of a desktop status monitoring method according to an embodiment of this application;

[0048] Figure 2 This is a schematic diagram of the structure of an embodiment of the desktop status monitoring system provided in this application;

[0049] Figure 3 This is a schematic diagram of the structure of an embodiment of the electronic device provided in this application. Detailed Implementation

[0050] The embodiments of this application are described in detail below. Examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain this application, and should not be construed as limiting this application.

[0051] In the description of this application, the use of terms such as "first," "second," etc., is for the purpose of distinguishing technical features only and should not be construed as indicating or implying relative importance or implicitly indicating the number of technical features indicated or the order of the technical features indicated.

[0052] In the description of this application, it should be understood that the orientation descriptions, such as up, down, etc., are based on the orientation or positional relationship shown in the accompanying drawings, and are only for the convenience of describing this application and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of this application.

[0053] In the description of this application, it should be noted that, unless otherwise explicitly defined, terms such as "setup," "installation," and "connection" should be interpreted broadly, and those skilled in the art can reasonably determine the specific meaning of the above terms in this application in conjunction with the specific content of the technical solution.

[0054] With the rapid development of information technology, desktop monitoring is becoming increasingly important in areas such as network security, enterprise management, and user behavior analysis.

[0055] Currently, methods for monitoring desktop status suffer from delays in data collection and analysis, failing to reflect dynamic changes in the desktop in a timely manner and making it difficult to respond to sudden security incidents or abnormal user behavior.

[0056] To address the aforementioned technical deficiencies, embodiments of this application provide a desktop status monitoring method, system, device, and storage medium.

[0057] Please see Figure 1 This is a flowchart illustrating a desktop status monitoring method provided in an embodiment of this application. The method is applied to an electronic device, which may be a server, etc. Figure 1 As shown, the desktop status monitoring method includes:

[0058] Step S101: Obtain the first desktop environment data, first user behavior data, and first business process data of historical users, and the second desktop environment data, second user behavior data, and second business process data of the target user;

[0059] Step S102: Based on the first desktop environment data, the first user behavior data, and the first business process data, construct a first knowledge graph, wherein the first knowledge graph includes at least one of desktop entities, behavior entities, business entities, entity relationships, alarm categories, and optimization strategies;

[0060] Step S103: Construct an initial desktop status monitoring model. Train the initial desktop status monitoring model based on the first desktop environment data, the first user behavior data, and the first business process data to obtain the trained desktop status monitoring model and desktop status prediction results.

[0061] Step S104: Update the first knowledge graph based on the desktop state prediction results to obtain the second knowledge graph;

[0062] Step S105: Based on the second desktop environment data, the second user behavior data, and the second business process data, determine the desktop status monitoring results of the target user through the trained desktop status monitoring model and the second knowledge graph.

[0063] This method acquires first desktop environment data, first user behavior data, and first business process data of historical users, and second desktop environment data, second user behavior data, and second business process data of the target user. Based on the first desktop environment data, first user behavior data, and first business process data, a first knowledge graph is constructed, wherein the first knowledge graph includes at least one of desktop entities, behavior entities, business entities, entity relationships, alarm categories, and optimization strategies. This application integrates multi-dimensional monitoring data through the knowledge graph to construct an initial desktop status monitoring model. The initial desktop status monitoring model is trained based on the first desktop environment data, first user behavior data, and first business process data to obtain a trained desktop status monitoring model and desktop status prediction results. The first knowledge graph is updated based on the desktop status prediction results to obtain a second knowledge graph. This application achieves real-time monitoring of the desktop through prediction using the desktop status monitoring model. Based on the second desktop environment data, second user behavior data, and second business process data, the desktop status monitoring results of the target user are determined through the trained desktop status monitoring model and the second knowledge graph. This application improves real-time monitoring capabilities and enhances monitoring comprehensiveness by combining graph query and model monitoring.

[0064] In some embodiments, based on second desktop environment data, second user behavior data, and second business process data, the desktop status monitoring results of the target user are determined through a trained desktop status monitoring model and a second knowledge graph, including:

[0065] Step S201: Input the second desktop environment data, the second user behavior data, and the second business process data into the second knowledge graph to obtain the graph query results;

[0066] Step S202: Input the second desktop environment data, the second user behavior data, and the second business process data into the trained desktop status monitoring model to obtain the desktop status prediction result.

[0067] Step S203: Match the graph query results and desktop status prediction results with the preset alarm rules to obtain the desktop status monitoring results of the target user.

[0068] In some embodiments, the above graph query results can be the types of insecure operations existing on the desktop;

[0069] The desktop state prediction results above can indicate the types of unsafe operations that may exist on the desktop.

[0070] The above-mentioned preset alarm rules can be for types of unsafe operations where both the graph query results and the desktop status prediction results show the same desktop.

[0071] In some embodiments, the desktop status monitoring method further includes:

[0072] Step S301: Match the desktop status monitoring results with the optimization strategies in the second knowledge graph to obtain the matching results;

[0073] Step S302: If the matching result is empty, input the desktop status monitoring result into the trained policy generation model to obtain the first optimized policy;

[0074] Step S304: Execute the first optimization strategy on the target user's desktop, and update the preset strategy indicators based on the execution result of the first optimization strategy;

[0075] Step S305: Optimize the second knowledge graph based on the updated preset strategy indicators;

[0076] Step S306: If the matching result is not empty, execute the matching result on the target user's desktop and update the preset strategy indicators based on the execution result of the matching result.

[0077] Step S307: Optimize the second knowledge graph based on the updated preset strategy indicators.

[0078] Specifically, in some embodiments, the similarity of different business scenarios is analyzed by graph neural networks (GNNs), and the strategy template of a certain scenario is migrated to a similar scenario. For example, the "R&D system code submission" strategy is migrated to the "design file upload" scenario. The similarity calculation adopts the graph edit distance algorithm, and the threshold is set to 0.7.

[0079] Specifically, the aforementioned updated preset policy indicators can be used for scenarios without clear rules (such as new operating modes), where a large model predicts the probability of risk and generates a temporary policy (such as temporarily increasing the monitoring frequency) when the probability exceeds a threshold (such as 70%). Alternatively, they can be used to optimize policy parameters, such as alarm thresholds, using reinforcement learning (RL) algorithms. Taking the "CPU usage alarm" policy as an example, the threshold is adjusted using the PPO algorithm, aiming to make the false alarm rate less than 5% and the false negative rate less than 1%. Furthermore, it can be used to generate preventative policies (such as releasing cache in advance) when a large model predicts potential risk trends (such as a memory leak probability greater than 80% in the next 2 hours).

[0080] In some embodiments, updating the first knowledge graph based on the desktop state prediction result to obtain the second knowledge graph includes:

[0081] Step S401: Filter the desktop status prediction results based on preset filtering rules to obtain the filtered prediction results;

[0082] Step S402: Update the first knowledge graph based on the prediction results after filtering to obtain the second knowledge graph.

[0083] Specifically, the above-mentioned preset screening rule can be that the confidence value of the desktop status prediction result must be greater than 80% to be considered as meeting the standard.

[0084] In some embodiments, an initial desktop status monitoring model is trained based on first desktop environment data, first user behavior data, and first business process data to obtain a trained desktop status monitoring model and desktop status prediction results, including:

[0085] Step S501: Input the first desktop environment data, the first user behavior data, and the first business process data into the initial desktop status monitoring model to obtain the first loss value;

[0086] Step S502: Update the initial desktop status monitoring model based on the first loss value until the loss value reaches the preset value or the number of training iterations reaches the preset number of iterations, and obtain the trained desktop status monitoring model and desktop status prediction results.

[0087] Specifically, the predictive capabilities of large-scale models can provide early warnings of potential failures. For example, if it is predicted that a server's hard drive is about to fail, the spare parts scheduling process can be automatically triggered.

[0088] In some embodiments, a first knowledge graph is constructed based on first desktop environment data, first user behavior data, and first business process data, including:

[0089] Step S601: Construct a first knowledge graph based on the first desktop environment data, the first user behavior data, and the first business process data using natural language processing technology.

[0090] Specifically, in some embodiments, constructing a first knowledge graph can model policy metadata: policy entities are defined in the knowledge graph, including attributes such as policy ID, type (alarm, block, and optimization), triggering conditions, and execution actions, and are connected to related entities through relationships (e.g., Policy.appliesTo.Application indicates that the policy acts on a certain application). Scenario-policy mapping: a triple relationship of "business scenario-risk type-policy template" is constructed. For example, the "financial system operation" scenario is connected to the "sensitive data leakage" risk through relativesTo.RiskType, and then associated with the corresponding monitoring policy template through requires.PolicyTemplate.

[0091] In some embodiments, acquiring historical user's first desktop environment data, first user behavior data, and first business process data includes:

[0092] Step S701: Collect initial desktop environment data, initial user behavior data and initial business process data of historical users according to preset rules. The initial desktop environment data includes at least one of screen and window data, application data and hardware resource data. The initial user behavior data includes at least one of input operation data and data interaction data. The initial business process data includes at least one of business association data and scene label data.

[0093] Step S702: Preprocess the initial desktop environment data to obtain the first desktop environment data; preprocess the initial user behavior data to obtain the first user behavior data; preprocess the initial business process data to obtain the first business process data.

[0094] Specifically, the aforementioned screen and window data can include data on desktop screen display, window open or closed status, window hierarchy, and changes in window content, used to monitor desktop visual status and user interface dynamics.

[0095] The application data mentioned above can include a list of running applications, process information (such as PID, CPU / memory usage), application version, window title, and interaction status data.

[0096] The aforementioned hardware resource data can include hardware resource indicators such as CPU utilization, memory usage, disk read / write speed, network traffic (upload or download speed, number of connections), and GPU usage.

[0097] The input operation data mentioned above can include recording keyboard key sequences (including timestamps and key combinations), mouse movement paths, click locations (left click, right click, scroll wheel operation), and click frequency.

[0098] The aforementioned data interaction data can be used to monitor clipboard content (text, file path), file operations (creating, modifying, deleting, copying, and pasting files and paths), and external device (USB flash drive, portable hard drive) insertion and removal records.

[0099] The aforementioned business-related data can include business system interface data related to desktop operations, business process node status (such as key steps like order creation and data submission), and business data interaction content (such as form filling and data query parameters).

[0100] The above scenario tag data can be the business scenario to which the current operation belongs (such as financial approval, customer service, code development) and the purpose of the operation (such as data entry, file editing, system configuration).

[0101] The aforementioned preset rules can be dynamic acquisition frequency control rules and acquisition priority management rules;

[0102] The above dynamic acquisition frequency control rules can be set to a screen acquisition frequency of 5-10 frames per second and a hardware resource acquisition interval of 1-5 seconds in normal scenarios, with real-time capture of user behavior operations; when CPU usage is detected to be greater than 80% or memory usage to be greater than 90%, the hardware resource acquisition frequency is automatically increased to 500ms per time, and screen acquisition is switched to keyframe capture; during critical steps in the business process (such as data submission and access to sensitive files), full screen recording and high-frequency operation recording are temporarily enabled to ensure data integrity.

[0103] The above-mentioned collection priority management rules can set user keyboard or mouse operations, sensitive file access records, and key business process node data as the highest priority in core data to ensure real-time transmission and storage; set hardware resource indicators and non-sensitive window status as medium priority in auxiliary data, and use batch transmission (such as packaging once every 10 seconds); set inactive window screens and regular application lists as low priority in redundant data, and can delay collection or pause when resources are scarce.

[0104] The above preprocessing includes noise reduction, data association and labeling, and data compression and caching.

[0105] Additionally, refer to Figure 2One embodiment of this application provides a desktop status monitoring system, including a data acquisition module 1100, a graph construction module 1200, a model training module 1300, a graph update module 1400, and a result determination module 1500, wherein:

[0106] The data acquisition module 1100 is used to acquire the first desktop environment data, first user behavior data, and first business process data of historical users, and the second desktop environment data, second user behavior data, and second business process data of target users;

[0107] The graph construction module 1200 is used to construct a first knowledge graph based on the first desktop environment data, the first user behavior data, and the first business process data. The first knowledge graph includes at least one of the following: desktop entities, behavior entities, business entities, entity relationships, alarm categories, and optimization strategies.

[0108] The model training module 1300 is used to build an initial desktop status monitoring model. Based on the first desktop environment data, the first user behavior data and the first business process data, the initial desktop status monitoring model is trained to obtain the trained desktop status monitoring model and desktop status prediction results.

[0109] The graph update module 1400 is used to update the first knowledge graph based on the desktop state prediction results to obtain the second knowledge graph.

[0110] The result determination module 1500 is used to determine the desktop status monitoring results of the target user based on the second desktop environment data, the second user behavior data, and the second business process data, through a trained desktop status monitoring model and a second knowledge graph.

[0111] This system acquires historical user desktop environment data, user behavior data, and business process data, as well as target user desktop environment data, user behavior data, and business process data. Based on the first desktop environment data, user behavior data, and business process data, a first knowledge graph is constructed, which includes at least one of desktop entities, behavior entities, business entities, entity relationships, alarm categories, and optimization strategies. This application integrates multi-dimensional monitoring data through the knowledge graph to construct an initial desktop status monitoring model. The initial desktop status monitoring model is trained based on the first desktop environment data, user behavior data, and business process data to obtain a trained desktop status monitoring model and desktop status prediction results. The first knowledge graph is updated based on the desktop status prediction results to obtain a second knowledge graph. This application achieves real-time desktop monitoring through prediction using the desktop status monitoring model. Based on the second desktop environment data, user behavior data, and business process data, the desktop status monitoring results for the target user are determined through the trained desktop status monitoring model and the second knowledge graph. By combining graph query and model monitoring, this application improves real-time monitoring capabilities and enhances monitoring comprehensiveness.

[0112] It should be noted that the system embodiments described above are based on the same inventive concept as the method embodiments described above. Therefore, the relevant content of the method embodiments described above is also applicable to the system embodiments described above, and will not be repeated here.

[0113] Figure 3 A schematic diagram of the rule mining hardware structure provided in an embodiment of this application is shown.

[0114] The desktop status monitoring device may include a processor 301 and a memory 302 storing computer program instructions.

[0115] Specifically, the processor 301 may include a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of this application.

[0116] Memory 302 may include mass storage for data or instructions. For example, and not limitingly, memory 302 may include a hard disk drive (HDD), floppy disk drive, flash memory, optical disk, magneto-optical disk, magnetic tape, or Universal Serial Bus (USB) drive, or a combination of two or more of these. Where appropriate, memory 302 may include removable or non-removable (or fixed) media. Where appropriate, memory 302 may be internal or external to the integrated gateway disaster recovery device. In a particular embodiment, memory 302 is non-volatile solid-state memory.

[0117] In some embodiments, memory 302 may include read-only memory (ROM), random access memory (RAM), disk storage media device, optical storage media device, flash memory device, electrical, optical, or other physical / tangible memory storage device. Thus, generally, memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to one aspect of this disclosure.

[0118] The processor 301 reads and executes computer program instructions stored in the memory 302 to implement any of the desktop status monitoring methods in the above embodiments.

[0119] In one example, the desktop status monitoring device may also include a communication interface 303 and a bus 310. For example, Figure 3 As shown, the processor 301, memory 302, and communication interface 303 are connected through bus 310 and complete communication with each other.

[0120] The communication interface 303 is mainly used to realize communication between various modules, devices, units and / or equipment in the embodiments of this application.

[0121] Bus 310 includes hardware, software, or both, that couples components of a desktop status monitoring device together. For example, and not limitingly, the bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), HyperTransport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a Microchannel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local (VLB) bus, or other suitable buses, or combinations of two or more of these. Where appropriate, bus 310 may include one or more buses. Although specific buses are described and illustrated in embodiments of this application, any suitable bus or interconnect is contemplated herein.

[0122] This desktop status monitoring device can execute the desktop status monitoring method in this application embodiment based on a 3D design model, thereby achieving a combination of... Figure 1 and Figure 2 The desktop status monitoring method and system are described.

[0123] Furthermore, in conjunction with the desktop status monitoring methods in the above embodiments, this application embodiment can provide a computer storage medium for implementation. The computer storage medium stores computer program instructions; when these computer program instructions are executed by a processor, they implement any of the desktop status monitoring methods in the above embodiments.

[0124] It should be clarified that this application is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of this application is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application.

[0125] The functional blocks shown in the above block diagram can be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this application are programs or code segments used to perform the required tasks. Programs or code segments can be stored on a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried on a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, fiber optic media, radio frequency (RF) links, etc. Code segments can be downloaded via computer networks such as the Internet, intranets, etc.

[0126] It should also be noted that the exemplary embodiments mentioned in this application describe methods or systems based on a series of steps or apparatus. However, this application is not limited to the order of the above steps; that is, the steps can be performed in the order mentioned in the embodiments, or in a different order, or several steps can be performed simultaneously.

[0127] The aspects of this disclosure have been described above with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It should be understood that each block in the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that these instructions, executable via the processor of the computer or other programmable data processing apparatus, enable the implementation of the functions / actions specified in one or more blocks of the flowchart illustrations and / or block diagrams. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field-programmable logic circuit. It is also understood that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can also be implemented by special-purpose hardware performing the specified functions or actions, or can be implemented by a combination of special-purpose hardware and computer instructions.

[0128] The above description is merely a specific implementation of this application. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, modules, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here. It should be understood that the protection scope of this application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and these modifications or substitutions should all be covered within the protection scope of this application.

Claims

1. A desktop status monitoring method, characterized in that, The desktop status monitoring method includes: Acquire the first desktop environment data, first user behavior data, and first business process data of historical users, and the second desktop environment data, second user behavior data, and second business process data of target users; Based on the first desktop environment data, the first user behavior data, and the first business process data, a first knowledge graph is constructed, wherein the first knowledge graph includes at least one of desktop entities, behavior entities, business entities, entity relationships, alarm categories, and optimization strategies; An initial desktop status monitoring model is constructed, and the initial desktop status monitoring model is trained based on the first desktop environment data, the first user behavior data, and the first business process data to obtain the trained desktop status monitoring model and desktop status prediction results. The first knowledge graph is updated based on the desktop state prediction results to obtain the second knowledge graph; Based on the second desktop environment data, the second user behavior data, and the second business process data, the desktop status monitoring result of the target user is determined through the trained desktop status monitoring model and the second knowledge graph, specifically as follows: Input the second desktop environment data, the second user behavior data, and the second business process data into the second knowledge graph to obtain the graph query results; Input the second desktop environment data, the second user behavior data, and the second business process data into the trained desktop status monitoring model to obtain desktop status prediction results; The graph query results and the desktop status prediction results are matched with preset alarm rules to obtain the desktop status monitoring results of the target user.

2. The desktop status monitoring method according to claim 1, characterized in that, The desktop status monitoring method also includes: The desktop status monitoring results are matched with the optimization strategies in the second knowledge graph to obtain the matching results; If the matching result is empty, the desktop status monitoring result is input into the trained policy generation model to obtain the first optimized policy; The first optimization strategy is executed on the target user's desktop, and the preset strategy indicators are updated based on the execution result of the first optimization strategy. The second knowledge graph is optimized based on the updated preset strategy indicators; If the matching result is not empty, the matching result is executed on the target user's desktop, and the preset strategy indicator is updated based on the execution result of the matching result; The second knowledge graph is optimized based on the updated preset strategy metrics.

3. The desktop status monitoring method according to claim 1, characterized in that, The step of updating the first knowledge graph based on the desktop state prediction result to obtain the second knowledge graph includes: The desktop state prediction results are filtered based on preset filtering rules to obtain filtered prediction results. The first knowledge graph is updated based on the prediction results after filtering to obtain the second knowledge graph.

4. The desktop status monitoring method according to claim 1, characterized in that, The step of training the initial desktop status monitoring model based on the first desktop environment data, the first user behavior data, and the first business process data to obtain the trained desktop status monitoring model and desktop status prediction results includes: The first desktop environment data, the first user behavior data, and the first business process data are input into the initial desktop state monitoring model to obtain the first loss value; The initial desktop status monitoring model is updated based on the first loss value until the loss value reaches a preset value or the number of training iterations reaches a preset number, thereby obtaining the trained desktop status monitoring model and the desktop status prediction result.

5. The desktop status monitoring method according to claim 1, characterized in that, The construction of the first knowledge graph based on the first desktop environment data, the first user behavior data, and the first business process data includes: The first knowledge graph is constructed using natural language processing based on the first desktop environment data, the first user behavior data, and the first business process data.

6. The desktop status monitoring method according to claim 1, characterized in that, The acquisition of historical user's first desktop environment data, first user behavior data, and first business process data includes: The initial desktop environment data, initial user behavior data, and initial business process data of historical users are collected according to preset rules. The initial desktop environment data includes at least one of screen and window data, application data, and hardware resource data. The initial user behavior data includes at least one of input operation data and data interaction data. The initial business process data includes at least one of business association data and scene tag data. The initial desktop environment data is preprocessed to obtain the first desktop environment data; the initial user behavior data is preprocessed to obtain the first user behavior data; and the initial business process data is preprocessed to obtain the first business process data.

7. A desktop status monitoring system, characterized in that, The desktop status monitoring system includes: The data acquisition module is used to acquire the first desktop environment data, first user behavior data, and first business process data of historical users, and the second desktop environment data, second user behavior data, and second business process data of target users. The graph construction module is used to construct a first knowledge graph based on the first desktop environment data, the first user behavior data, and the first business process data. The first knowledge graph includes at least one of desktop entities, behavior entities, business entities, entity relationships, alarm categories, and optimization strategies. The model training module is used to build an initial desktop status monitoring model. Based on the first desktop environment data, the first user behavior data, and the first business process data, the initial desktop status monitoring model is trained to obtain the trained desktop status monitoring model and desktop status prediction results. The knowledge graph update module is used to update the first knowledge graph based on the desktop state prediction result to obtain the second knowledge graph. The result determination module is used to determine the desktop status monitoring result of the target user based on the second desktop environment data, the second user behavior data, and the second business process data, through the trained desktop status monitoring model and the second knowledge graph. Specifically: Input the second desktop environment data, the second user behavior data, and the second business process data into the second knowledge graph to obtain the graph query results; Input the second desktop environment data, the second user behavior data, and the second business process data into the trained desktop status monitoring model to obtain desktop status prediction results; The graph query results and the desktop status prediction results are matched with preset alarm rules to obtain the desktop status monitoring results of the target user.

8. A desktop status monitoring device, characterized in that, It includes at least one control processor and a memory for communicatively connecting to the at least one control processor; the memory stores instructions executable by the at least one control processor, which, when executed by the at least one control processor, enable the at least one control processor to perform a desktop status monitoring method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions for causing a computer to perform a desktop status monitoring method as described in any one of claims 1 to 6.

Images