Risk monitoring model training method, risk monitoring method, equipment, medium and program

Abstract

The embodiment of the invention discloses a risk monitoring model training method and device, a risk monitoring method and device, a medium and a program, and relates to the technical field of computer software application and financial science and technology, and the risk monitoring model training method comprises the steps: obtaining target object sample data of a target monitoring object; performing interval classification processing on the target object sample data to obtain a classification interval circular ring graph of the target monitoring object; generating a sample comprehensive representation body of the target monitoring object according to the multi-dimensional risk monitoring index of the target monitoring object; generating a sample data broken line graph of the target monitoring object according to the classification interval circular ring graph and the sample comprehensive representation body; and inputting the sample data broken line graph as input data into a risk monitoring model so as to carry out a model training process on the risk monitoring model. According to the technical scheme of the embodiment of the invention, the risk monitoring accuracy and reliability of the risk monitoring model can be improved, and the risk prevention and control capability is further improved.

Description

Technical Field

[0001] The embodiments of the present invention relate to the fields of computer software applications and financial technology, and particularly to a risk monitoring model training and risk monitoring method, device, electronic device, storage medium and program. Background Technology

[0002] Risk monitoring has wide-ranging applications across various technological scenarios. Modern risk monitoring technology integrates advanced technologies such as big data, cloud computing, and machine learning. Big data technology helps analyze and mine more information, cloud computing provides powerful computing capabilities, and machine learning can predict future risks and assist in decision-making. For example, in the financial industry, these technologies can be used to analyze massive amounts of financial data in real time, identifying potential risks in advance. In the internet industry, these technologies can be used to analyze massive amounts of logs, traffic, and cloud computing resource data in real time to uncover potential risks.

[0003] As enterprises place increasing emphasis on information security, risk monitoring and management have become crucial means of safeguarding enterprise information security. How to make risk monitoring more accurate, efficient, and intelligent, transforming it from post-event analysis to pre-event warning and in-event control, has become a key focus in the field of risk monitoring. Summary of the Invention

[0004] This invention provides a risk monitoring model training and risk monitoring method, device, electronic device, storage medium and program, which can improve the accuracy and reliability of risk monitoring by the risk monitoring model, thereby improving risk prevention and control capabilities.

[0005] According to one aspect of the present invention, a method for training a risk monitoring model is provided, comprising:

[0006] Obtain target object sample data of the target monitoring object; wherein, the target object sample data includes at least one of log sample data, traffic sample data, and cloud resource statistics sample data;

[0007] The target object sample data is subjected to interval classification processing to obtain a classification interval pie chart of the target monitoring object;

[0008] Generate a comprehensive sample representation of the target monitoring object based on the multi-dimensional risk monitoring indicators of the target monitoring object;

[0009] Generate a line chart of sample data for the target monitoring object based on the described classification interval pie chart and the described sample comprehensive representation.

[0010] The line chart of the sample data is used as input data to the risk monitoring model for model training.

[0011] According to another aspect of the present invention, a risk monitoring method is provided, comprising:

[0012] Acquire target object data for a preset time period; wherein, the target object data includes at least one of log data, traffic data, and cloud resource statistics data.

[0013] Obtain the category interval pie chart of the target monitored object;

[0014] Generate the current comprehensive representation of the target monitoring object based on the current multi-dimensional risk monitoring indicators of the target monitoring object;

[0015] A real-time data line chart of the target monitoring object is generated based on the classification interval pie chart and the current comprehensive representation.

[0016] The real-time data line chart is used as input data to the risk monitoring model, so that the risk of the target monitoring object can be predicted in real time based on the real-time data line chart.

[0017] The risk monitoring model is trained using the risk monitoring model training method described in any embodiment of the present invention.

[0018] According to another aspect of the present invention, a risk monitoring model training apparatus is provided, comprising:

[0019] The target object sample data acquisition module is used to acquire target object sample data of the target monitored object; wherein, the target object sample data includes at least one of log sample data, traffic sample data, and cloud resource statistics sample data;

[0020] The classification interval donut chart generation module is used to perform interval classification processing on the target object sample data to obtain the classification interval donut chart of the target monitoring object.

[0021] The sample comprehensive representation generation module is used to generate a sample comprehensive representation of the target monitoring object based on the multi-dimensional risk monitoring indicators of the target monitoring object.

[0022] The sample data line chart generation module is used to generate a sample data line chart of the target monitoring object based on the classification interval pie chart and the sample comprehensive representation.

[0023] The risk monitoring model training module is used to input the sample data line chart as input data into the risk monitoring model to perform the model training process.

[0024] According to another aspect of the present invention, a risk monitoring device is provided, comprising:

[0025] The target object data acquisition module is used to acquire target object data of the target monitored object within a preset time period; wherein, the target object data includes at least one of log data, traffic data, and cloud resource statistics data.

[0026] The classification interval pie chart acquisition module is used to acquire the classification interval pie chart of the target monitoring object;

[0027] The current comprehensive representation generation module is used to generate the current comprehensive representation of the target monitoring object based on the current multi-dimensional risk monitoring indicators of the target monitoring object;

[0028] The real-time data line chart generation module is used to generate a real-time data line chart of the target monitoring object based on the classification interval pie chart and the current comprehensive representation body.

[0029] The risk prediction module is used to input the real-time data line chart as input data into the risk monitoring model, so that the risk monitoring model can predict the risk of the target monitoring object in real time based on the real-time data line chart.

[0030] The risk monitoring model is trained using the risk monitoring model training method described in any embodiment of the present invention.

[0031] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0032] At least one processor; and

[0033] A memory communicatively connected to the at least one processor; wherein,

[0034] The memory stores a computer program that can be executed by the at least one processor, which enables the at least one processor to perform the risk monitoring model training method or risk monitoring method according to any embodiment of the present invention.

[0035] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions, the computer instructions being configured to cause a processor to execute and implement the risk monitoring model training method or risk monitoring method described in any embodiment of the present invention.

[0036] According to another aspect of the present invention, a computer program product is also provided, comprising a computer program that, when executed by a processor, implements the risk monitoring model training method or risk monitoring method described in any embodiment of the present invention.

[0037] This invention, in its embodiments, acquires at least one type of target object sample data from log sample data, traffic sample data, and cloud resource statistical sample data. This data is then used to perform interval classification processing, resulting in a classification interval pie chart of the target object. A comprehensive sample representation of the target object is generated based on its multi-dimensional risk monitoring indicators. Finally, a sample data line chart of the target object is generated based on the classification interval pie chart and the comprehensive sample representation. After obtaining the sample data line chart, it can be used as input data to a risk monitoring model for model training. Once the risk monitoring model is trained, target object data collected over a preset time period and the corresponding classification interval pie chart are acquired. A current comprehensive representation of the target object is generated based on its current multi-dimensional risk monitoring indicators. A real-time data line chart of the target object is then generated based on the classification interval pie chart and the current comprehensive representation. This real-time data line chart is used as input data to the risk monitoring model, allowing the model to predict the risk of the target object in real time based on the real-time data line chart. The above technical solution introduces multi-dimensional risk monitoring indicators to establish a comprehensive representation of the target monitoring object from multi-dimensional related factors, and combines the classification interval pie chart of the target monitoring object for risk prediction. It can analyze the potential risks of the target monitoring object from the overall trend of data change, solve the problem of poor risk prevention and control capabilities of existing risk monitoring methods, improve the accuracy and reliability of risk monitoring models, and thus improve risk prevention and control capabilities.

[0038] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0039] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0040] Figure 1 This is a flowchart of a risk monitoring model training method provided in an embodiment of the present invention;

[0041] Figure 2 This is a flowchart of another risk monitoring model training method provided in an embodiment of the present invention;

[0042] Figure 3This is a schematic diagram of a classification interval pie chart of a target monitoring object provided in an embodiment of the present invention;

[0043] Figure 4 This is a schematic diagram illustrating the effect of a target monitoring object in a sample integrated representation, provided by an embodiment of the present invention.

[0044] Figure 5 This is a schematic diagram illustrating the effect of a line graph of sample data provided in an embodiment of the present invention;

[0045] Figure 6 This is a schematic diagram illustrating the effect of another sample data line graph provided in an embodiment of the present invention;

[0046] Figure 7 This is a flowchart of a risk monitoring method provided in an embodiment of the present invention;

[0047] Figure 8 This is a schematic diagram of a risk monitoring model training device provided in an embodiment of the present invention;

[0048] Figure 9 This is a schematic diagram of a risk monitoring device provided in an embodiment of the present invention;

[0049] Figure 10 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0050] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0051] It should be noted that the terms "comprising" and "having" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are explicitly listed, but may include other steps or units that are not explicitly listed or that are inherent to such process, method, product or device.

[0052] Figure 1This is a flowchart of a risk monitoring model training method provided by an embodiment of the present invention. This embodiment is applicable to training a risk monitoring model based on a classification interval pie chart and a comprehensive sample representation of the target monitoring object. This method can be executed by a risk monitoring model training device, which can be implemented in software and / or hardware, and is generally integrated into an electronic device. This electronic device can be a terminal device or a server device, as long as it can execute the risk monitoring model training method. This embodiment of the present invention does not limit the specific type of electronic device. Correspondingly, as... Figure 1 As shown, the method includes the following operations:

[0053] S110. Obtain target object sample data of the target monitoring object; wherein, the target object sample data includes at least one of log sample data, traffic sample data, and cloud resource statistical sample data.

[0054] The target monitoring object can be any type of object requiring risk monitoring. The target object sample data can be sample data collected from the target monitoring object and can serve as a data source for risk monitoring of the target monitoring object.

[0055] In this embodiment of the invention, the risk monitoring model can be applied to any risk monitoring scenario to provide risk monitoring functionality. Before using the risk monitoring model for risk monitoring, the specific application scenario of the risk monitoring model can be determined first, and then the target monitoring object can be determined based on the specific application scenario of the risk monitoring model. Subsequently, target object sample data of the target monitoring object can be collected and obtained for training the risk monitoring model.

[0056] For example, when applying a risk monitoring model to the field of log monitoring, the application or system that generates log data can be used as the target monitoring object, and the log data generated by the target monitoring object can be used as the target object sample data. Log data records various activities of the system, including logins, operational behaviors, and system failures. Log risk monitoring, through real-time monitoring and analysis using log data, can promptly detect security events such as abnormal login behavior, data breaches, and network attacks.

[0057] For example, when applying a risk monitoring model to traffic monitoring, network devices or systems related to traffic data can be used as target monitoring objects, and the traffic data generated by these target monitoring objects can be used as target object sample data. Traffic risk monitoring can monitor data flow in the network in real time, detect abnormal traffic patterns, which may indicate potential network attacks or intrusions, thereby enabling timely measures to prevent security threats.

[0058] For example, when applying a risk monitoring model to cloud resource monitoring, entities applying for cloud resource usage, such as various organizations, can be designated as target monitoring objects, and the statistical data on cloud resource usage applied for by these target monitoring objects can be used as sample data for the target monitoring objects. By monitoring cloud resource usage in real time, issues such as performance degradation or abnormal resource consumption can be detected promptly, allowing measures to be taken to avoid business interruptions. For instance, when server performance degrades or resource consumption becomes abnormal, cloud resource risk monitoring can provide early warnings, giving users sufficient time to optimize resource configuration or take countermeasures, thereby ensuring business continuity and stability.

[0059] It is understandable that, in addition to log risk monitoring, traffic risk monitoring, and cloud resource risk monitoring, target object sample data of target monitoring objects in other fields can also be collected and obtained according to actual needs, such as financial activity data in the financial field or big data sample data in the big data field. The embodiments of the present invention do not limit the specific type of target object sample data of target monitoring objects and the corresponding specific application scenarios.

[0060] S120. Perform interval classification processing on the target object sample data to obtain a classification interval pie chart of the target monitoring object.

[0061] Among them, the classification interval pie chart can be a pie chart formed by classifying multiple classification intervals based on the number of target object sample data and constructing a pie chart based on multiple classification intervals.

[0062] Understandably, even for different target monitoring objects within the same domain, the amount of sample data collected for each target object will differ. For example, if Company A is a large internet company, its requested cloud resource data volume may be larger, while if Company B is a small non-internet company, its requested cloud resource data volume may be smaller. Large system applications, such as data center applications, generate a large amount of log data, while small software applications, such as a simple app, generate a smaller amount of log data. The amount of sample data generated for each target monitoring object should match the size of that target monitoring object.

[0063] Accordingly, the target object sample data for each monitored object can be categorized into intervals based on the amount of data. Each category of target object sample data represents the range of data volume for that category. Furthermore, a classification interval donut chart adapted to the monitored object can be generated based on the interval classification results of the target object sample data. It can be understood that each ring in the classification interval donut chart represents the range of data volume for the target object sample data.

[0064] S130. Generate a comprehensive sample representation of the target monitoring object based on the multi-dimensional risk monitoring indicators of the target monitoring object.

[0065] The multidimensional risk monitoring indicators can be monitoring indicators determined from multiple dimensions based on the type of the target monitoring object. This embodiment of the invention does not limit the types of the various monitoring indicators included in the multidimensional risk monitoring indicators. The sample comprehensive representation can be a comprehensive representation generated based on the multidimensional risk monitoring indicators of the target monitoring object. This comprehensive representation can characterize the monitoring range of the corresponding target monitoring object from multiple dimensions of monitoring indicators.

[0066] Furthermore, to achieve multi-dimensional monitoring of the target object, it is possible to determine the multi-dimensional risk monitoring indicators applicable to the target object, and then generate a comprehensive sample representation based on these indicators. For example, in the field of log monitoring, the comprehensive sample representation can represent the target object's limited annotation information based on the data monitoring period, limited annotation information based on the target object's functional points, real-time target object sample data, and limited annotation information for large-volume target object sample data. The comprehensive sample representation generated from the target object's multi-dimensional risk monitoring indicators can represent the risk status of the target object corresponding to a certain dimension of risk monitoring indicators. Similarly, traffic sample data and cloud resource statistical sample data can be analyzed in a similar way to determine the multi-dimensional risk monitoring indicators applicable to the target object, and then generate a comprehensive sample representation based on these indicators.

[0067] Understandably, the multi-dimensional risk monitoring indicators for each target monitoring object may need to be adjusted at different risk monitoring times. For example, Company A's management system generated less log data in January, but due to the reorganization and merger completed in February, it generated more log data in March. Therefore, the sample composite representation generated by Company A's management system in January is different from the sample composite representation generated in March.

[0068] S140. Generate a line graph of sample data for the target monitoring object based on the classification interval pie chart and the sample comprehensive representation.

[0069] The sample data line chart can be a graph composed of line graphs representing the trajectory points of the comprehensive sample representation for each target monitored object within the classification interval donut chart. The trajectory point line graph can be a line graph composed of the individual movement trajectory points of the comprehensive sample representation within the classification interval donut chart.

[0070] Accordingly, after generating the classification interval donut chart and the sample composite representation of the target monitored object, the sample composite representation can represent the target monitored object, and the distribution position points of the sample composite representation in the classification interval donut chart can be determined based on the target object sample data. Furthermore, connecting the distribution position points of the sample composite representation of the target monitored object in the classification interval donut chart yields the change trajectory point polyline of the target monitored object's sample composite representation in the classification interval donut chart. Since each target monitored object can have a corresponding change trajectory point polyline generated in the classification interval donut chart, the change trajectory point polylines generated for each target monitored object in the classification interval donut chart can constitute a sample data polyline chart.

[0071] S150. The line chart of the sample data is input into the risk monitoring model as input data to perform the model training process for the risk monitoring model.

[0072] After obtaining the line chart of the sample data, it can be used as training data and input into the risk monitoring model to train it. The accuracy of the risk monitoring model will improve with each training iteration. During the training process, the number of iterations can be set to guide the overall training progress. Alternatively, the loss value or accuracy of the risk monitoring model can be evaluated, and the training process can be stopped when the loss value or accuracy meets the requirements.

[0073] Understandably, the amount of sample data generated for each monitored object should match the size of that object. Furthermore, the overlay between the comprehensive sample representation and the classification interval donut chart for each monitored object can reflect its risk level. If the data volume of a monitored object's sample data shows a relatively flat trend, the trend of the line chart corresponding to the change trajectory points will also be relatively flat, indicating a lower probability of risk. Conversely, if the data volume of a monitored object's sample data shows an abnormally large range of change, the range of the line chart corresponding to the change trajectory points will also be large, indicating a higher probability of risk. If there is no overlay between the comprehensive sample representation and the classification interval donut chart for a monitored object, the probability of risk is low; if the overlay area is large, the probability of risk is high. Therefore, by analyzing the trend of the line chart in the sample data and the overlay between the comprehensive sample representation and the classification interval donut chart, the risk monitoring model can determine the potential risk of the monitored object.

[0074] Optionally, the risk monitoring model can be any available machine learning model, such as a deep learning model or a large model, as long as it can provide risk monitoring functions for the target monitoring object based on the training process of the training data. This embodiment of the invention does not limit the specific model type of the risk monitoring model.

[0075] This invention, in its embodiments, acquires at least one type of target object sample data from log sample data, traffic sample data, and cloud resource statistical sample data. This target object sample data is then subjected to interval classification processing to obtain a classification interval pie chart of the target object. Based on the multi-dimensional risk monitoring indicators of the target object, a comprehensive representation of the target object's samples is generated. Finally, a sample data line chart of the target object is generated based on the classification interval pie chart and the comprehensive representation. After obtaining the sample data line chart, it can be used as input data to a risk monitoring model for model training. This technical solution, by introducing multi-dimensional risk monitoring indicators to establish a comprehensive representation of the target object from multi-dimensional related factors, and combining this with the classification interval pie chart of the target object to train the risk monitoring model, can improve the accuracy and reliability of risk monitoring, thereby enhancing risk prevention and control capabilities.

[0076] Figure 2 This is a flowchart of another risk monitoring model training method provided by an embodiment of the present invention. This embodiment is based on the above embodiment and is further specified. In this embodiment, various specific optional implementation methods are given for performing interval classification processing on the target object sample data, generating a comprehensive sample representation of the target monitoring object, and generating a line graph of the sample data. Correspondingly, as Figure 2 As shown, the method in this embodiment may include:

[0077] S210. Obtain target object sample data of the target monitoring object; wherein, the target object sample data includes at least one of log sample data, traffic sample data, and cloud resource statistical sample data.

[0078] S220. Based on the variation pattern of the sample data of the target monitoring object, perform interval classification processing on the sample data of the target object to obtain multiple sample classification intervals.

[0079] Among them, the sample classification interval can be an interval divided according to the data volume variation pattern of the target object sample data.

[0080] Specifically, when creating a pie chart for the classification intervals of a target monitored object, one can first observe the variation pattern of the sample data in the data volume dimension. Based on this variation pattern, the target object's sample data can be classified into multiple intervals. It's understandable that different types of target monitored objects will result in different data volume ranges corresponding to their respective classification intervals.

[0081] In a specific example, taking the application or system that generates log data as the target monitoring object, assuming that the target monitoring object has an initial log data volume, it can be classified according to the initial log data volume of the target monitoring object and the changes in the real-time log data volume of the target monitoring object in the past six months, resulting in multiple sample classification intervals as shown in Table 1.

[0082] Table 1 Sample classification intervals of real-time log data volume of the target monitoring object

[0083]

[0084] It should be noted that the initial log data volume in Table 1 represents the initial log data volume of the target monitored object when the real-time log data volume is less than or equal to 3TB. If the real-time log data volume of the target monitored object exceeds 3TB, it enters the next category interval, and the real-time log data volume exceeding 3TB becomes the initial log data volume of the target monitored object in the next category interval. Also, Table 1 only shows the categories where the real-time log data volume is less than or equal to 3TB. The other categories of real-time log data volume are as follows: A: [0, 3TB]; B: (3TB, 6TB]; (6TB, 9TB]; (9TB, 15TB]... etc.

[0085] S230. Determine the radius of the corresponding circular region based on each of the sample classification intervals, and generate a circular annular graph of the classification intervals of the target monitoring object based on the radius of the circular region corresponding to each of the sample classification intervals.

[0086] Correspondingly, after determining multiple sample classification intervals, each sample classification interval can be set with a corresponding circular area radius. At the same time, each sample classification interval is set to draw a circle based on the same center and the corresponding circular area radius, thereby generating a classification interval pie chart of the target monitoring object. Figure 3 This is a schematic diagram of a classification interval pie chart of a target monitoring object provided in an embodiment of the present invention. In a specific example, assuming the sample classification interval of the real-time log data volume of the target monitoring object shown in Table 1 is taken as an example, the following can be generated accordingly: Figure 3 The diagram shows a pie chart of classification intervals. It should be noted that... Figure 3 Only a partial sample classification interval, namely A, is shown in the diagram.11 -A 21 .

[0087] The above technical solution divides the target object sample data into multiple sample classification intervals and sets the radius of the circular area according to the size relationship of each sample classification interval, thereby generating a pie chart of the classification intervals of the target monitoring object. This can intuitively display the distribution characteristics of the target object sample data in the data volume dimension, and improve the readability and analysis efficiency of the distribution characteristics of the target object sample data in the data volume dimension.

[0088] S240. Determine the radius length of the target monitoring object in the sample comprehensive representation based on the multi-dimensional risk monitoring index threshold of the target monitoring object.

[0089] Among them, the threshold of the multidimensional risk monitoring indicator can be the threshold of the multidimensional risk monitoring indicator.

[0090] S250. Generate each sector area in the sample comprehensive representation body according to the radius length corresponding to the target monitoring object in the sample comprehensive representation body.

[0091] Each sector in the sample composite representation represents a monitoring requirement for a risk monitoring indicator.

[0092] Specifically, when generating a comprehensive sample representation of a target monitoring object, the threshold values ​​of the multi-dimensional risk monitoring indicators corresponding to the target monitoring object can be determined first. Each risk monitoring indicator can have a matching threshold set for each target monitoring object. Different target monitoring objects will have different configurations of their corresponding multi-dimensional risk monitoring indicator thresholds. Furthermore, the radius length of the target monitoring object in the comprehensive sample representation can be determined based on its multi-dimensional risk monitoring indicator thresholds, thereby generating various sector regions in the comprehensive sample representation based on the radius length of the target monitoring object. Optionally, one risk monitoring indicator can correspond to one sector region in the comprehensive sample representation.

[0093] Figure 4 This is a schematic diagram illustrating the effect of a target monitoring object in a sample comprehensive representation, provided by an embodiment of the present invention. In a specific example, the application or system that generates log data is used as the target monitoring object for illustration. Figure 4As shown, the multi-dimensional risk monitoring indicators of the target monitoring object include a total of 5 dimensions of risk monitoring indicators, namely "time division units based on day, week, ten-day period and month", "functional points based on target monitoring object", "real-time log data volume of target monitoring object", "functional items in the cumulative log data volume that exceed the cumulative preset limit" and "large volume of log data". Correspondingly, for risk monitoring indicators "based on daily, weekly, ten-day, and monthly time units," each target monitoring object can set a threshold for "distinguishing boundaries based on daily, weekly, ten-day, and monthly time units"; for risk monitoring indicators "based on target monitoring object function points," each target monitoring object can set a threshold for "marking based on target monitoring object function point division"; for risk monitoring indicators "real-time log data volume of target monitoring objects," each target monitoring object can set a threshold for "marking the real-time log data volume of target monitoring objects"; for risk monitoring indicators "function items exceeding the cumulative preset limit in cumulative log data volume," each target monitoring object can set a threshold for "marking function items exceeding the cumulative preset limit in cumulative log data volume"; and for risk monitoring indicators "large volume of log data," each target monitoring object can set a threshold for "marking large amounts of log data entering and leaving." Accordingly, each target monitoring object determines the radius length of each risk monitoring indicator in the target monitoring object's sample comprehensive representation body through the above five risk monitoring indicator thresholds. For example, the threshold for "distinguishing between time units based on days, weeks, ten-day periods, and months" is set to a radius of 5cm in the sample comprehensive representation of the target monitored object, resulting in: Figure 4 The area shown is a sector-shaped region A. It is understandable that the shape of the generated sample composite representation may differ depending on the target being monitored.

[0094] In the sample comprehensive representation, the radius of each sector can represent the numerical value or the degree of severity. For example, when a sector represents "large amount of log data entering and leaving", the radius of the sector can correspondingly represent the size of the daily preset log data limit of the target monitored object.

[0095] Therefore, each sector in the comprehensive sample representation of the target monitoring object can represent the monitoring requirements for that target monitoring object's risk monitoring indicators in that dimension. The application of the comprehensive sample representation allows for a comprehensive analysis of the target monitoring object's data to identify potential risks from multiple dimensions of monitoring indicators, thus improving the comprehensiveness and rationality of the monitoring of the target monitoring object.

[0096] S260. Based on the target object sample data of the target monitoring object, determine the various discrete points of the sample comprehensive representation of the target monitoring object in the classification interval annular diagram, and configure the corresponding sample comprehensive representation at each of the discrete points.

[0097] Among them, the discrete points can be the position points of the sample comprehensive representation in the classification interval annulus.

[0098] It's understandable that the classification interval donut chart is a graph generated for all target monitoring objects within the same monitoring scenario, while the sample comprehensive representation is a graph generated for a specific target monitoring object. After generating the classification interval donut charts for all target monitoring objects and generating the sample comprehensive representation for each target monitoring object, the distribution discrete points of the sample comprehensive representation for each target monitoring object in the classification interval donut chart can be determined based on the classification interval donut chart. Furthermore, after determining the distribution discrete points, the corresponding sample comprehensive representation for the target monitoring object can be configured at each distribution discrete point.

[0099] Specifically, based on the sampling time and data volume of the target object's sample data, the discrete points of the comprehensive representation of each target object's sample in the classification interval donut chart can be determined. For example, one circle in the classification interval donut chart can represent a one-year period. If the data collection period is monthly, a circle can include the discrete points of 12 comprehensive representations of a single target object. Simultaneously, the amount of target object sample data collected each month determines the specific position of that target object's comprehensive representation within the donut. It can be understood that the larger the amount of target object sample data, the further out the comprehensive representation of that target object will be within the donut.

[0100] S270. Connect the discrete points according to the sampling time sequence of the distributed discrete points using a broken line method to obtain a broken line graph of the sample data of the target monitoring object.

[0101] Since each discrete point corresponds to a sampling time of the target object's sample data, a line graph of the target monitoring object's sample data can be obtained by connecting the discrete points sequentially according to the sampling time of the target object's sample data.

[0102] Figure 5 This is a schematic diagram illustrating the effect of a sample data line chart provided in an embodiment of the present invention. In a specific example, such as... Figure 5The line chart shown illustrates the trajectory of three monitored targets over a six-month period, represented by discrete points. Each line's inflection point represents a discrete point, and the data at these discrete points is presented in a comprehensive representation. Figure 4 (The sample composite representation, which does not show all discrete distribution points, represents the amount of target object sample data collected at the corresponding sampling time and the specific threshold configuration of the corresponding multi-dimensional risk monitoring indicators.) Figure 4 As shown, the first discrete point of the broken line representing the change trajectory points within the outermost ring is closer to the outside of the ring than the second discrete point. This indicates that the amount of sample data corresponding to the first discrete point is greater than the amount of sample data corresponding to the second discrete point. The different shapes of the comprehensive representation of the same monitored target at different discrete points indicate that the threshold values ​​of the multi-dimensional risk monitoring indicators configured for the monitored target differ at different times.

[0103] Therefore, the above technical solution, by graphically representing the distribution of the target monitoring object's sample data in the classification interval pie chart, more intuitively displays the distribution characteristics of the target monitoring object's sample data in the data volume dimension and the monitoring requirements of risk monitoring indicators in other different dimensions. This can improve the readability and analysis efficiency of the distribution characteristics of the target object's sample data in the data volume dimension and the monitoring requirements of risk monitoring indicators.

[0104] In an optional embodiment of the present invention, after generating the sample data line chart of the target monitoring object based on the classification interval pie chart and the sample comprehensive representation, the method may further include: determining the intersection area of ​​the sample comprehensive representation and the classification interval pie chart; determining the interval span of the sample data line in the sample data line chart within the classification interval pie chart; and generating classification label information for the sample data line chart based on the intersection area of ​​the sample comprehensive representation and the classification interval pie chart and the interval span of the sample data line in the sample data line chart within the classification interval pie chart.

[0105] The sample data polyline can be generated by connecting discrete points in a polyline format, i.e., a polyline of change trajectory points. Each sample data polyline can represent the trajectory of the sample aggregate representation in the classification interval donut chart.

[0106] Understandably, if the threshold values ​​of certain risk monitoring indicators corresponding to the sample composite representation are too high, or if the amount of sample data collected for the target object corresponding to a certain discrete point in the classification interval donut chart is too large, then the sample composite representation may overlap with the classification interval donut chart. Alternatively, when the difference in the amount of sample data collected for two adjacent discrete points in the classification interval donut chart is too large, the sample data line in the sample composite representation may exhibit a cross-circular trend in the classification interval donut chart. For example, as... Figure 3 As shown, the data volume of target object sample data collected in January was 1.4TB. Therefore, the first discrete point of the comprehensive representation of the target object sample in the classification interval pie chart is located in circle A. 11 Within February, the data volume of target object sample data collected for this monitored object was 2.9TB. Therefore, the second discrete point of the comprehensive representation of the target monitored object's sample in the classification interval pie chart is located in circle A. 21 Within the sample data curve of the comprehensive representation of the target monitored object, the line graph shows a cross-ring pattern in the classification interval donut chart. Therefore, the intersection area between the comprehensive representation of the sample data and the classification interval donut chart can be determined to ascertain whether the target monitored object's sample data poses a risk. Simultaneously, the interval span of the sample data curve in the line graph within the classification interval donut chart can also be determined to ascertain whether the target monitored object's sample data poses a risk.

[0107] Specifically, if there is an intersection between the sample composite representation and the classification interval donut chart (i.e., the intersection area is not zero), or if the sample data line in the sample data line chart has a large interval span in the classification interval donut chart, it can be determined that the target object's sample data is at risk. For example, if a log-generating application or system's function generates a large amount of log data in a short period, it indicates that the application or system's function is highly active or has suffered a large-scale malicious attack requiring comprehensive counter-attack measures. Therefore, if the intersection area between the sample composite representation and the classification interval donut chart is not zero, or if the sample data line in the sample data line chart has a large interval span in the classification interval donut chart, it can be determined that the classification label information of the target monitored object's corresponding change trajectory point line in the sample data line chart is abnormal. Conversely, if there is no intersection between the sample composite representation and the classification interval donut chart, and the sample data line in the sample data line chart has a small interval span in the classification interval donut chart (e.g., it always changes within the same circle), it can be determined that the classification label information of the target monitored object's corresponding change trajectory point line in the sample data line chart is normal.

[0108] Figure 6 This is a schematic diagram illustrating the effect of another sample data line chart provided in an embodiment of the present invention. In a specific example, such as Figure 6 As shown, if a six-month period is taken as a whole, a line graph of sample data can be generated in half of the area in the classification interval pie chart. Figure 6 (a) The sample data line does not change across regions and always fluctuates within the outermost ring. Furthermore, the sample composite representation does not intersect with the boundary of the ring. Therefore, the classification label information of the sample data line graph is normal. Figure 6 (b) Although the boundary between the sample composite representation and the ring does not intersect, the sample data line graph shows cross-regional changes, so the classification label information of the sample data line graph is abnormal.

[0109] The above technical solution classifies the sample data line graph by using the intersection area between the sample comprehensive representation and the classification interval annulus, as well as the interval span of the sample data line graph in the classification interval annulus. This can improve the accuracy of the sample data line graph classification, and thus improve the accuracy of the risk monitoring model trained based on the sample data line graph.

[0110] S280. The line chart of the sample data is input into the risk monitoring model as input data to perform the model training process for the risk monitoring model.

[0111] Accordingly, after the sample data comprehensive representation in the sample data line chart is generated based on the direction of each sample data line, the sample data line chart can be used as input data to the risk monitoring model to carry out the model training process until the risk monitoring model training is completed.

[0112] Since many parameters of the risk monitoring model need to be determined during deep learning, several parameter combinations can be designed and trained separately during initial training. The training dataset, consisting of several sample line charts, is used as input images to train the convolutional neural network model. The loss function can be a normalized exponential function. After training, initial models corresponding to different parameter combinations are obtained. Then, the initial models are tested using a test dataset consisting of sample line charts. The model with the largest deviation from the input images in the test dataset is determined as the final risk monitoring model, and its parameters can also be used as the final model parameters. Risk monitoring of target objects can be performed according to different risk levels, such as low, medium, and high risk.

[0113] The above technical solution identifies the discrete points of the sample composite representation of the target monitored object within the classification interval pie chart. Corresponding sample composite representations are then configured at each discrete point. These discrete points are connected by a broken line according to their sampling time sequence, resulting in a line chart of the target monitored object's sample data. This line chart is then used as input to the risk monitoring model for training. Since the line chart visually represents the feature distribution of the target monitored object across different dimensions, the risk monitoring model trained based on this line chart can improve the accuracy and reliability of risk monitoring.

[0114] Figure 7 This is a flowchart of a risk monitoring method provided by an embodiment of the present invention. This embodiment is applicable to situations where risk monitoring is performed based on a trained risk monitoring model. The method can be executed by a risk monitoring device, which can be implemented in software and / or hardware, and is generally integrated into an electronic device. This electronic device can be a terminal device or a server device, as long as it can execute the risk monitoring method. The present invention does not limit the specific type of electronic device. Correspondingly, as... Figure 7 As shown, the method includes the following operations:

[0115] S310. Obtain target object collection data of the target monitoring object within a preset time period; wherein, the target object collection data includes at least one of log collection data, traffic collection data, and cloud resource statistics collection data.

[0116] The preset time period can be a time period that matches the future monitoring time of the target object. The data collected from the target object can be data collected in real time from the target object within the preset time period.

[0117] For example, when applying the risk monitoring model to the field of log monitoring, the application or system that generates log data can be used as the target monitoring object, and the log data generated by the target monitoring object in the most recent 3 or 4 months can be used as the log collection data of the target monitoring object.

[0118] For example, when applying the risk monitoring model to the field of traffic monitoring, network devices or systems related to traffic data can be used as target monitoring objects, and traffic data generated by the target monitoring objects in the most recent 3 or 4 months can be used as traffic collection data of the target monitoring objects.

[0119] For example, when applying the risk monitoring model to the field of cloud resource monitoring, the objects applying to use cloud resources, such as various institutions, can be used as target monitoring objects, and the statistical data of cloud resources applied to by the target monitoring objects in the most recent 3 or 4 months can be used as the cloud resource statistical collection data of the target monitoring objects.

[0120] S320. Obtain the classification interval pie chart of the target monitoring object.

[0121] Since the classification interval pegmap has already been processed during the training phase of the risk monitoring model, when using the trained risk monitoring model for risk monitoring, the classification interval pegmap of the target monitoring object can be obtained directly by performing interval classification processing on the target object sample data.

[0122] S330. Generate the current comprehensive representation of the target monitoring object based on the current multi-dimensional risk monitoring indicators of the target monitoring object.

[0123] Among them, the current multi-dimensional risk monitoring indicators are monitoring indicators determined from multiple dimensions based on the type of the target monitoring object during the current risk monitoring stage. The current comprehensive representation is a comprehensive representation generated in real time based on the current multi-dimensional risk monitoring indicators of the target monitoring object. This comprehensive representation can characterize the monitoring scope of the corresponding target monitoring object from multiple dimensions of monitoring indicators.

[0124] It should be noted that the type of the current multidimensional risk monitoring indicator must be the same as the type of the multidimensional risk monitoring indicator used to generate the sample comprehensive representation of the target monitoring object. This is to avoid the risk monitoring model being unable to effectively identify and utilize risk monitoring indicator types not involved in the training process. Therefore, when risk monitoring of a target monitoring object is required, the method of generating the sample comprehensive representation of the target monitoring object during the risk monitoring model training process can be referenced to determine the type of the current multidimensional risk monitoring indicator. Then, the threshold of the current multidimensional risk monitoring indicator can be determined in real time. Based on the current multidimensional risk monitoring indicator threshold of the target monitoring object, the radius length corresponding to the target monitoring object in the current comprehensive representation can be determined. Finally, based on the radius length corresponding to the target monitoring object in the current comprehensive representation, each sector region in the current comprehensive representation is generated, resulting in the current comprehensive representation adapted to the target monitoring object.

[0125] S340. Generate a real-time data line chart of the target monitoring object based on the classification interval pie chart and the current comprehensive representation.

[0126] The real-time data line chart can be a graph composed of line segments representing the trajectory points of the current integrated representation of each monitored target within the classification interval pie chart. The line segments in the real-time data line chart can be composed of the trajectory points of each action of the current integrated representation within the classification interval pie chart.

[0127] Accordingly, after obtaining the classification interval donut chart of the target monitored object and generating the current comprehensive representation of the target monitored object in real time, the current comprehensive representation can represent the target monitored object, and the distribution position point of the current comprehensive representation in the classification interval donut chart can be determined based on the target object sample data of the target monitored object. Furthermore, connecting the distribution position points of the current comprehensive representation of the target monitored object in the classification interval donut chart yields the change trajectory point polyline of the current comprehensive representation of the target monitored object in the classification interval donut chart. Since each target monitored object can generate a corresponding change trajectory point polyline in the classification interval donut chart, the change trajectory point polylines generated for each target monitored object in the classification interval donut chart can constitute a real-time data polyline chart.

[0128] In an optional embodiment of the present invention, generating a real-time data line chart of the target monitored object based on the classification interval pie chart and the current comprehensive representation may include: determining each discrete point of the current comprehensive representation of the target monitored object in the classification interval pie chart based on the target object collection data of the target monitored object; configuring a corresponding current comprehensive representation at each of the discrete points; and connecting the discrete points in the order of their corresponding sampling times using a line graph to obtain the real-time data line chart of the target monitored object.

[0129] In this embodiment of the invention, the generation principle of the real-time data line chart and the sample data line chart is the same. Since each discrete point in the current comprehensive representation of the classification interval pie chart corresponds to a sampling time of the target object's collected data, each discrete point can be connected sequentially using a line method according to the chronological order of the sampling time of the target object's collected data to obtain the real-time data line chart of the target monitoring object.

[0130] Therefore, the above technical solution can graphically display the distribution characteristics of the target monitoring object's current comprehensive representation in the classification interval pie chart, and intuitively show the distribution characteristics of the target monitoring object's collected data in the data volume dimension within a preset time period, as well as the monitoring requirements characteristics of risk monitoring indicators in other different dimensions. This can improve the readability and analysis efficiency of the distribution characteristics of the target object's collected data in the data volume dimension and the monitoring requirements characteristics of risk monitoring indicators.

[0131] S350. The real-time data line chart is input into the risk monitoring model as input data, so that the risk monitoring model can predict the risk of the target monitoring object in real time based on the real-time data line chart.

[0132] The risk monitoring model is trained using the risk monitoring model training method described in any embodiment of the present invention.

[0133] Accordingly, after obtaining the real-time data line chart of the target monitoring object, the real-time data line chart can be used as input data to the trained risk monitoring model, so that the risk monitoring model can automatically predict whether there is a risk to the target monitoring object in real time based on the real-time data line chart.

[0134] Specifically, the risk monitoring model can infer from real-time data line charts whether the target object has changed its current integrated representation, i.e., whether the target object is a risk object. If the risk monitoring model determines that the target object has changed its current integrated representation, the model outputs a modified integrated representation for reference. The modified integrated representation is then converted into risk customization requirements, enabling proactive risk screening and timely fulfillment of system security assurance.

[0135] Optionally, expert experience rules (such as risk list matching) can be combined with risk monitoring models in time-series analysis to form a collaborative framework of "rule pre-screening + model fine screening" to monitor the risk threshold of the target monitoring object. If the limit is exceeded, it is judged as a risk object.

[0136] Accurate risk monitoring enables enterprises to promptly identify and address potential risks, reduce losses, and ensure the company's steady development. Through a systematic risk monitoring system, enterprises can formulate corresponding risk control strategies for different types of risks and implement specific risk control measures, improving the effectiveness of risk control and risk prevention capabilities. Improved accuracy of risk monitoring models provides management with more reliable risk information, helping them make more scientific and rational decisions. For example, in risk management reports, accurate risk data allows senior management to better understand the risks faced by the company, thereby formulating risk management strategies that are more aligned with the company's strategy and business objectives. Accurate risk identification avoids excessive focus and resource allocation to non-risk events, allowing enterprises to concentrate limited resources on risks that truly need to be addressed, improving resource utilization efficiency. Simultaneously, reducing false alarm rates also reduces unnecessary alerts and interference, improving resource utilization efficiency and the overall efficiency of the monitoring system.

[0137] This invention, in its embodiments, acquires at least one type of target object sample data from log sample data, traffic sample data, and cloud resource statistical sample data. This data is then used to perform interval classification processing, resulting in a classification interval pie chart of the target object. A comprehensive sample representation of the target object is generated based on its multi-dimensional risk monitoring indicators. Finally, a sample data line chart of the target object is generated based on the classification interval pie chart and the comprehensive sample representation. After obtaining the sample data line chart, it can be used as input data to a risk monitoring model for model training. Once the risk monitoring model is trained, target object data collected over a preset time period and the corresponding classification interval pie chart are acquired. A current comprehensive representation of the target object is generated based on its current multi-dimensional risk monitoring indicators. A real-time data line chart of the target object is then generated based on the classification interval pie chart and the current comprehensive representation. This real-time data line chart is used as input data to the risk monitoring model, allowing the model to predict the risk of the target object in real time based on the real-time data line chart. The above technical solution introduces multi-dimensional risk monitoring indicators to establish a comprehensive representation of the target monitoring object from multi-dimensional related factors, and combines the classification interval pie chart of the target monitoring object for risk prediction. It can analyze the potential risks of the target monitoring object from the overall trend of data change, solve the problem of poor risk prevention and control capabilities of existing risk monitoring methods, improve the accuracy and reliability of risk monitoring models, and thus improve risk prevention and control capabilities.

[0138] It should be noted that all information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display, data used for analysis, such as target object sample data such as log sample data, traffic sample data and cloud resource statistical sample data, or target object collected data such as log collection data, traffic collection data and cloud resource statistical collection data) involved in this disclosure are information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data comply with the relevant laws, regulations and standards of the relevant regions.

[0139] It should be noted that any arrangement or combination of the technical features in the above embodiments also falls within the protection scope of this invention.

[0140] Figure 8 This is a schematic diagram of a risk monitoring model training device provided in an embodiment of the present invention, as shown below. Figure 8 As shown, the device includes: a target object sample data acquisition module 410, a classification interval pie chart generation module 420, a sample comprehensive representation generation module 430, a sample data line chart generation module 440, and a risk monitoring model training module 450, wherein:

[0141] The target object sample data acquisition module 410 is used to acquire target object sample data of the target monitored object; wherein, the target object sample data includes at least one of log sample data, traffic sample data, and cloud resource statistical sample data;

[0142] The classification interval pie chart generation module 420 is used to perform interval classification processing on the target object sample data to obtain the classification interval pie chart of the target monitoring object.

[0143] The sample comprehensive representation generation module 430 is used to generate a sample comprehensive representation of the target monitoring object based on the multi-dimensional risk monitoring indicators of the target monitoring object;

[0144] The sample data line chart generation module 440 is used to generate a sample data line chart of the target monitoring object based on the classification interval pie chart and the sample comprehensive representation.

[0145] The risk monitoring model training module 450 is used to input the sample data line chart as input data into the risk monitoring model to perform the model training process.

[0146] This invention, in its embodiments, acquires at least one type of target object sample data from log sample data, traffic sample data, and cloud resource statistical sample data. This target object sample data is then subjected to interval classification processing to obtain a classification interval pie chart of the target object. Based on the multi-dimensional risk monitoring indicators of the target object, a comprehensive representation of the target object's samples is generated. Finally, a sample data line chart of the target object is generated based on the classification interval pie chart and the comprehensive representation. After obtaining the sample data line chart, it can be used as input data to a risk monitoring model for model training. This technical solution, by introducing multi-dimensional risk monitoring indicators to establish a comprehensive representation of the target object from multi-dimensional related factors, and combining this with the classification interval pie chart of the target object to train the risk monitoring model, can improve the accuracy and reliability of risk monitoring, thereby enhancing risk prevention and control capabilities.

[0147] Optionally, the classification interval pie chart generation module 420 is further configured to: perform interval classification processing on the sample data of the target monitoring object according to the sample data change pattern of the target monitoring object to obtain multiple sample classification intervals; determine the radius of the corresponding circular area according to each sample classification interval; and generate a classification interval pie chart of the target monitoring object according to the radius of the circular area corresponding to each sample classification interval.

[0148] Optionally, the sample comprehensive representation generation module 430 is further configured to: determine the radius length corresponding to the target monitoring object in the sample comprehensive representation based on the multidimensional risk monitoring index threshold of the target monitoring object; generate each sector area in the sample comprehensive representation based on the radius length corresponding to the target monitoring object in the sample comprehensive representation; wherein, each sector area in the sample comprehensive representation represents the monitoring requirement of a risk monitoring index.

[0149] Optionally, the sample data line graph generation module 440 is further configured to: determine the discrete points of the sample comprehensive representation of the target monitoring object in the classification interval annular graph based on the target object sample data of the target monitoring object; configure the corresponding sample comprehensive representation at each of the discrete points; and connect the discrete points in a line manner according to the chronological order of the sampling time corresponding to the discrete points to obtain the sample data line graph of the target monitoring object.

[0150] Optionally, the above-mentioned device further includes a classification label information generation module, used to: determine the intersection area of ​​the sample comprehensive representation and the classification interval pie chart; determine the interval span of the sample data line in the sample data line chart in the classification interval pie chart; and generate classification label information of the sample data line chart based on the intersection area of ​​the sample comprehensive representation and the classification interval pie chart and the interval span of the sample data line in the sample data line chart in the classification interval pie chart.

[0151] The aforementioned risk monitoring model training device can execute the risk monitoring model training method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the method. Technical details not described in detail in this embodiment can be found in the risk monitoring model training method provided in any embodiment of the present invention.

[0152] Figure 9 This is a schematic diagram of a risk monitoring device provided in an embodiment of the present invention, such as... Figure 9 As shown, the device includes: a target object data acquisition module 510, a classification interval pie chart acquisition module 520, a current comprehensive representation generation module 530, a real-time data line chart generation module 540, and a risk prediction module 550, wherein:

[0153] The target object data acquisition module 510 is used to acquire target object data of the target monitored object within a preset time period; wherein, the target object data includes at least one of log data, traffic data, and cloud resource statistics data.

[0154] The classification interval pie chart acquisition module 520 is used to acquire the classification interval pie chart of the target monitoring object;

[0155] The current comprehensive representation generation module 530 is used to generate the current comprehensive representation of the target monitoring object based on the current multi-dimensional risk monitoring indicators of the target monitoring object;

[0156] The real-time data line chart generation module 540 is used to generate a real-time data line chart of the target monitoring object based on the classification interval pie chart and the current comprehensive representation body.

[0157] The risk prediction module 550 is used to input the real-time data line chart as input data into the risk monitoring model, so that the risk monitoring model can predict the risk of the target monitoring object in real time based on the real-time data line chart.

[0158] The risk monitoring model is trained using the risk monitoring model training method described in any embodiment of the present invention.

[0159] This invention, in its embodiments, acquires at least one type of target object sample data from log sample data, traffic sample data, and cloud resource statistical sample data. This data is then used to perform interval classification processing, resulting in a classification interval pie chart of the target object. A comprehensive sample representation of the target object is generated based on its multi-dimensional risk monitoring indicators. Finally, a sample data line chart of the target object is generated based on the classification interval pie chart and the comprehensive sample representation. After obtaining the sample data line chart, it can be used as input data to a risk monitoring model for model training. Once the risk monitoring model is trained, target object data collected over a preset time period and the corresponding classification interval pie chart are acquired. A current comprehensive representation of the target object is generated based on its current multi-dimensional risk monitoring indicators. A real-time data line chart of the target object is then generated based on the classification interval pie chart and the current comprehensive representation. This real-time data line chart is used as input data to the risk monitoring model, allowing the model to predict the risk of the target object in real time based on the real-time data line chart. The above technical solution introduces multi-dimensional risk monitoring indicators to establish a comprehensive representation of the target monitoring object from multi-dimensional related factors, and combines the classification interval pie chart of the target monitoring object for risk prediction. It can analyze the potential risks of the target monitoring object from the overall trend of data change, solve the problem of poor risk prevention and control capabilities of existing risk monitoring methods, improve the accuracy and reliability of risk monitoring models, and thus improve risk prevention and control capabilities.

[0160] Optionally, the real-time data line chart generation module 540 is further configured to: determine the current comprehensive representation of the target monitoring object in the classification interval annular graph based on the target object collection data of the target monitoring object; configure the corresponding current comprehensive representation at each of the distribution discrete points; and connect the distribution discrete points in a line manner according to the chronological order of the sampling time corresponding to the distribution discrete points to obtain the real-time data line chart of the target monitoring object.

[0161] The risk monitoring device described above can execute the risk monitoring method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the method. Technical details not described in detail in this embodiment can be found in the risk monitoring method provided in any embodiment of the present invention.

[0162] Figure 10 A schematic diagram of an electronic device 10 that can be used to implement embodiments of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0163] like Figure 10 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 may also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0164] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0165] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as risk monitoring model training methods or risk monitoring methods.

[0166] Optionally, the risk monitoring model training method may include: acquiring target object sample data of the target monitoring object; wherein the target object sample data includes at least one of log sample data, traffic sample data, and cloud resource statistical sample data; performing interval classification processing on the target object sample data to obtain a classification interval pie chart of the target monitoring object; generating a comprehensive sample representation of the target monitoring object based on the multi-dimensional risk monitoring indicators of the target monitoring object; generating a sample data line chart of the target monitoring object based on the classification interval pie chart and the comprehensive sample representation; and inputting the sample data line chart as input data into the risk monitoring model to perform the model training process of the risk monitoring model.

[0167] Optionally, the risk monitoring method may include: acquiring target object collection data for a target monitoring object within a preset time period; wherein the target object collection data includes at least one of log collection data, traffic collection data, and cloud resource statistics collection data; acquiring a classification interval pie chart of the target monitoring object; generating a current comprehensive representation of the target monitoring object based on the current multi-dimensional risk monitoring indicators of the target monitoring object; generating a real-time data line chart of the target monitoring object based on the classification interval pie chart and the current comprehensive representation; inputting the real-time data line chart as input data into a risk monitoring model, so as to predict the risk of the target monitoring object in real time based on the real-time data line chart by the risk monitoring model; wherein the risk monitoring model is trained by the risk monitoring model training method described in any embodiment of the present invention.

[0168] In some embodiments, the risk monitoring model training method or risk monitoring method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the risk monitoring model training method or risk monitoring method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to execute the risk monitoring model training method or risk monitoring method by any other suitable means (e.g., by means of firmware).

[0169] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0170] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0171] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0172] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0173] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0174] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through a communication network. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0175] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this disclosure can be achieved, and this is not limited herein.

[0176] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A method for training a risk monitoring model, characterized in that, include: Obtain target object sample data of the target monitoring object; wherein, the target object sample data includes at least one of log sample data, traffic sample data, and cloud resource statistics sample data; The target object sample data is subjected to interval classification processing to obtain a classification interval pie chart of the target monitoring object; Generate a comprehensive sample representation of the target monitoring object based on the multi-dimensional risk monitoring indicators of the target monitoring object; Generate a line chart of sample data for the target monitoring object based on the described classification interval pie chart and the described sample comprehensive representation. The line chart of the sample data is used as input data to the risk monitoring model for model training.

2. The method according to claim 1, characterized in that, The step of performing interval classification processing on the target object sample data to obtain a classification interval pie chart of the target monitoring object includes: Based on the variation pattern of the sample data of the target monitoring object, the sample data of the target object is classified into intervals to obtain multiple sample classification intervals; The radius of the corresponding circular region is determined based on the classification interval of each sample. A circular annular graph of the target monitoring object is generated based on the radius of the circular region corresponding to each of the sample classification intervals.

3. The method according to claim 1, characterized in that, The step of generating a comprehensive sample representation of the target monitoring object based on the multi-dimensional risk monitoring indicators of the target monitoring object includes: The radius length of the target monitoring object in the sample comprehensive representation is determined based on the multidimensional risk monitoring index threshold of the target monitoring object. Generate each sector area in the sample comprehensive representation body according to the radius length corresponding to the target monitoring object in the sample comprehensive representation body; Each sector in the sample composite representation represents a monitoring requirement for a risk monitoring indicator.

4. The method according to claim 1, characterized in that, The step of generating a line chart of sample data for the target monitoring object based on the classification interval pie chart and the sample comprehensive representation includes: Based on the target object sample data of the target monitoring object, determine the discrete distribution points of the sample comprehensive representation of the target monitoring object in the classification interval annulus diagram; A corresponding sample comprehensive representation is configured at each of the aforementioned discrete distribution points; By connecting the discrete points in the order of their corresponding sampling times using a broken line, a line graph of the sample data of the target monitoring object is obtained.

5. The method according to claim 1, characterized in that, After generating the line chart of sample data for the target monitoring object based on the classification interval pie chart and the sample comprehensive representation, the method further includes: Determine the area of ​​intersection between the sample composite representation and the classification interval annulus; Determine the interval span of the sample data line in the sample data line graph within the classification interval donut chart; The classification label information of the sample data line graph is generated based on the intersection area of ​​the sample comprehensive representation and the classification interval pie chart, and the interval span of the sample data line graph in the classification interval pie chart.

6. A risk monitoring method, characterized in that, include: Acquire target object data for a preset time period; wherein, the target object data includes at least one of log data, traffic data, and cloud resource statistics data. Obtain the category interval pie chart of the target monitored object; Generate the current comprehensive representation of the target monitoring object based on the current multi-dimensional risk monitoring indicators of the target monitoring object; A real-time data line chart of the target monitoring object is generated based on the classification interval pie chart and the current comprehensive representation. The real-time data line chart is used as input data to the risk monitoring model, so that the risk of the target monitoring object can be predicted in real time based on the real-time data line chart. The risk monitoring model is trained using the risk monitoring model training method described in any one of claims 1-5.

7. The method according to claim 6, characterized in that, The step of generating a real-time data line chart of the target monitoring object based on the classification interval pie chart and the current comprehensive representation includes: Based on the target object data collected from the target monitoring object, determine the current comprehensive representation of the target monitoring object at each discrete distribution point in the classification interval annular graph; At each of the aforementioned discrete distribution points, a corresponding current integrated representation is configured; By connecting the discrete points in the order of their corresponding sampling times using a broken line, a real-time data broken line graph of the target monitoring object is obtained.

8. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that is executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the risk monitoring model training method of any one of claims 1-5, or to perform the risk monitoring method of any one of claims 6-7.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute the risk monitoring model training method of any one of claims 1-5, or to perform the risk monitoring method of any one of claims 6-7.

10. A computer program product comprising a computer program / instructions, wherein, When the computer program / instruction is executed by the processor, it implements the risk monitoring model training method of any one of claims 1-5, or performs the risk monitoring method of any one of claims 6-7.

Images