An operating system checking method, device, equipment, storage medium and product

Abstract

The application discloses an operating system checking method and device, equipment, a storage medium and a product, relates to the technical field of servers, and obtains various checking indexes of an operating system; a first checking result of a target checking index is determined according to a matching position of the target checking index in a multi-way tree. Based on an error correction condition corresponding to the first checking result, the target checking index is analyzed to determine a second checking result of the target checking index, thereby guaranteeing the accuracy of the second checking result. According to a set early warning rule, the second checking result corresponding to each checking index is comprehensively analyzed to determine an early warning result. According to the depth search of the multi-way tree, parallel processing of the various checking indexes can be realized while the checking accuracy is ensured, and the checking efficiency is improved. Furthermore, through comprehensive analysis of all the detection results, abnormal conditions of the operating system can be found in time, early warning is realized, and the security of the operating system is improved.

Description

Technical Field

[0001] This application relates to the field of server technology, and in particular to an operating system checking method, apparatus, device, storage medium, and product. Background Technology

[0002] As the foundational software of a computer, the operating system undertakes core functions such as scheduling hardware resources, managing process communication, and ensuring data security. It serves as the basic platform upon which upper-layer business software runs. Although many operating systems have undergone security hardening and protection for business security, systems are constantly changing, making regular system health checks essential.

[0003] Traditional health check methods simply examine relevant items and cannot predict whether there are any dangers. Users need to assess whether their current status is normal. Due to the limited understanding of operating system malfunctions by users, abnormalities may not be detected in time, leading to serious failures.

[0004] It is evident that how to achieve automated fault early warning is a problem that needs to be solved by those skilled in the art. Summary of the Invention

[0005] This application provides an operating system inspection method, apparatus, device, storage medium, and product to at least address the problem in related technologies that manual analysis cannot detect anomalies in a timely manner.

[0006] This application provides an operating system inspection method, including:

[0007] Obtain various check indicators of the operating system;

[0008] Based on the matching position of the target inspection index in the multi-branch tree, the first inspection result of the target inspection index is determined; where the target inspection index is any one of the inspection indicators; the multi-branch tree contains multiple layers of branches, the first layer is the root node, the second layer contains position nodes, the third layer contains the inspection items corresponding to each position node, the fourth layer contains the initial inspection conditions corresponding to each inspection item, and the fifth layer contains the error correction conditions corresponding to each first inspection result.

[0009] Based on the error correction conditions corresponding to the first inspection result, the target inspection index is analyzed to determine the second inspection result of the target inspection index.

[0010] According to the established early warning rules, the second inspection results corresponding to each inspection indicator are comprehensively analyzed to determine the early warning result.

[0011] This application also provides an operating system inspection device, including an acquisition unit, a determination unit, a correction unit, and an analysis unit;

[0012] The acquisition unit is used to acquire various inspection indicators of the operating system;

[0013] The determining unit is used to determine the first inspection result of the target inspection indicator based on the matching position of the target inspection indicator in the multi-branch tree; wherein, the target inspection indicator is any one of the inspection indicators; the multi-branch tree contains multiple layers of branches, the first layer is the root node, the second layer contains position nodes, the third layer contains the inspection items corresponding to each position node, the fourth layer contains the initial inspection conditions corresponding to each inspection item, and the fifth layer contains the error correction conditions corresponding to each first inspection result.

[0014] The correction unit is used to analyze the target inspection index based on the error correction conditions corresponding to the first inspection result, so as to determine the second inspection result of the target inspection index.

[0015] The analysis unit is used to comprehensively analyze the second inspection results corresponding to each inspection indicator according to the set early warning rules in order to determine the early warning result.

[0016] This application also provides an electronic device, including: a memory for storing a computer program; and a processor for implementing the steps of any of the above-described operating system checking methods when executing the computer program.

[0017] This application also provides a computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the steps of any of the above-described operating system checking methods.

[0018] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of any of the above-described operating system checking methods.

[0019] This application obtains various inspection indicators of the operating system; based on the matching position of the target inspection indicator in a multi-branch tree, the first inspection result of the target inspection indicator is determined; wherein, the target inspection indicator is any one of the various inspection indicators. The multi-branch tree contains multiple levels of branches: the first level is the root node, the second level contains position nodes, the third level contains the inspection items corresponding to each position node, the fourth level contains the initial inspection conditions corresponding to each inspection item, and the fifth level contains the error correction conditions corresponding to each first inspection result. Parallel processing of various inspection indicators can be achieved using the multi-branch tree matching method, improving inspection efficiency. Furthermore, error correction conditions are set at the fifth level of the multi-branch tree. Based on the error correction conditions corresponding to the first inspection result, the target inspection indicator is analyzed to determine the second inspection result of the target inspection indicator, ensuring the accuracy of the second inspection result. Before a real problem occurs in the operating system, there are often some abnormal indicators. Considering that the detection result corresponding to a single inspection indicator may not fully reflect the abnormal situation of the operating system, the second inspection results corresponding to each inspection indicator can be comprehensively analyzed according to the set early warning rules to determine the early warning result. This technical solution utilizes a built-in multi-branch tree for depth-first search, ensuring accuracy while enabling parallel processing of various inspection indicators, thus improving efficiency. The built-in multi-branch tree and the matching of inspection indicators based on it do not consume excessive system resources, allowing for operating system health checks with minimal performance and resource consumption. Furthermore, comprehensive analysis of all detection results allows for timely detection of operating system anomalies, providing early warnings before problems actually occur, thereby enhancing operating system security. Attached Figure Description

[0020] To more clearly illustrate the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 A flowchart illustrating an operating system inspection method provided in this application embodiment;

[0022] Figure 2 A schematic diagram of a multi-branch tree provided for an embodiment of this application;

[0023] Figure 3 A flowchart illustrating a method for determining the target location of a target inspection index in a multi-branch tree, as provided in this application embodiment;

[0024] Figure 4This is a schematic diagram of the structure of an operating system inspection device provided in an embodiment of this application. Detailed Implementation

[0025] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the protection scope of this application.

[0026] It should be noted that, in the description of this application, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. The terms "first," "second," etc., in this application are used to distinguish similar objects and are not used to describe a specific order or sequence.

[0027] To enable those skilled in the art to better understand the present application, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0028] Large data centers currently serve as the service foundation for many industries, with hundreds or even thousands of servers providing services being the norm. For example, an internet company providing online ticketing services requires servers with high computing power and cannot afford to be downtime. In data centers with a large number of servers operating similar versions, regular operating system checks are necessary to anticipate problems and monitor system health. However, simple checks cannot detect potential risks in advance.

[0029] Operating systems often store numerous parameter anomalies before encountering problems. To avoid remediation after issues occur, this application provides an operating system inspection method, apparatus, device, storage medium, and product. By using a built-in multi-branch tree to perform deep searches on various detection indicators, it ensures inspection accuracy while enabling parallel processing of various indicators, thus improving inspection efficiency. Through comprehensive analysis of all detection results, abnormal situations in the operating system can be detected promptly, providing early warnings before actual problems occur, thereby enhancing operating system security. For example, in many cases, data loss and configuration errors in the operating system can be detected through self-checking functions, providing early warnings of business errors or even system crashes.

[0030] The operating system inspection solution provided in this application can provide real-time early warnings during the operating system installation, normal use, and crisis stages. During the installation phase, a self-check is performed after the operating system is installed. If incorrect settings or system versions are found, a warning can be issued to the installed system, prompting the user to pause the installation. During normal use, regular health checks can be performed, sending daily reports to the user to keep them informed of the overall system health. In the crisis phase, when an attack or security incident occurs, the system will inevitably undergo changes. For example, Trojan viruses may enter through open system ports, and ransomware files may encrypt files in critical system directories. Health checks will periodically check for any additional open ports, sudden increases or decreases in system directory files, and, for example, whether a mining virus suddenly saturates the processor. The purpose of operating system inspection is to provide early warnings of faults at minimal cost.

[0031] The embodiments of this application provide an operating system checking method, and the method is described in detail below in conjunction with the execution flow of the operating system checking method.

[0032] Figure 1 A flowchart of an operating system checking method provided in this application embodiment includes:

[0033] S101: Obtain various check indicators of the operating system.

[0034] To perform health checks on the operating system, a periodic time can be set to periodically collect various check indicators of the operating system.

[0035] The indicators can be divided into two main categories: indicators corresponding to user space and indicators corresponding to kernel space.

[0036] In user-mode metrics, these can include processor utilization, memory free space, disk utilization, firewall status, and port status. Kernel-mode metrics can include whether reserved regions are enabled, whether large page memory is enabled, and whether memory dump files can be generated.

[0037] S102: Determine the first inspection result of the target inspection indicator based on the matching position of the target inspection indicator in the multi-branch tree.

[0038] The target inspection indicator is any one of the various inspection indicators.

[0039] In this embodiment of the application, a multi-branch tree is used to perform in-depth search and analysis on various inspection indicators. The multi-branch tree can realize parallel processing of various inspection indicators. The processing flow of each inspection indicator is similar. Therefore, the description is based on any one of the inspection indicators, namely the target inspection indicator.

[0040] A multi-branch tree contains multiple levels of branches. For the analysis needs of the operating system, in this embodiment, a five-level multi-branch tree structure can be used: the first level is the root node, the second level contains position nodes, the third level contains the check items corresponding to each position node, the fourth level contains the initial check conditions corresponding to each check item, and the fifth level contains the error correction conditions corresponding to each first check result.

[0041] Each subtree of a multi-branch tree has multiple levels, and the content corresponding to each level can include values ​​under fault conditions for that project. These values ​​can be a specific numerical value or a list. When a project is found, the system will indicate whether it matches. Furthermore, it will perform a comprehensive matching based on the values ​​from different subtrees. This multi-branch tree algorithm integrates built-in logic for matching problem scenarios. Multi-branch trees can be used to periodically check various indicators of the operating system and to perform pre-inference of problems based on the check results.

[0042] In practical applications, a multi-branch tree structure with 25 subtrees can be generated to address data center issues. 20 subtrees record application-layer user-space configurations or datasets, and 5 subtrees record kernel-space configurations and kernel parameter sets. The top layer is a root tree; after data filtering and distribution, data enters the bottom layer, which contains a set of finely categorized issues.

[0043] Figure 2 This diagram illustrates a multi-branch tree provided in an embodiment of this application. The multi-branch tree has five levels. The first level is the root node. The second level represents the location, including two branches: user mode and kernel mode. The third level contains check items; for example, user mode includes 20 check items such as memory and processor; kernel mode includes 5 check items such as whether a reserved area is used and whether large page memory is enabled. The fourth level corresponds to the preliminary check results, and the fifth level contains the refined check results. Considering that the multi-branch tree contains many subtrees, this diagram is provided for clarity. Figure 2 The diagram only shows a portion of the branches. Taking user-mode memory as an example, the initial check results can include two branches: normal and abnormal. The normal state can be further subdivided into memory usage greater than 50% and memory usage between 5% and 50%. Memory abnormalities include memory overflow, etc.

[0044] Taking target inspection metrics as an example, the target inspection metrics are input into the root node. The root node will determine the target position of the target inspection metrics in the multi-branch tree based on the collection location of the target inspection metrics.

[0045] The target location can include both user mode and kernel mode.

[0046] Different target locations contain different inspection items. The target inspection index can be compared with each inspection item contained under the target location to determine the target inspection item that matches the target inspection index. Based on the threshold conditions corresponding to the target inspection item, the first inspection result of the target inspection index is determined.

[0047] S103: Based on the error correction conditions corresponding to the first inspection result, analyze the target inspection index to determine the second inspection result of the target inspection index.

[0048] The fifth layer of the multi-branched number can contain error correction conditions corresponding to each first inspection result.

[0049] In this embodiment of the application, the main purpose of performing a health check on the operating system is to provide early warnings. Therefore, the second check result may include the early warning risk level corresponding to the check indicators.

[0050] In practice, the result value contained in the first inspection result can be adjusted according to the correction coefficient corresponding to the first inspection result to obtain the adjusted result value; the adjusted result value is compared with multiple set partition ranges to determine the warning risk level matched by the adjusted proportion value; wherein, each partition range has its own corresponding warning risk level.

[0051] In the embodiments of this application, the result value can be adjusted according to the following formula: Adjusted result value = Result value contained in the first inspection result + random(0-0.1); where random is an error correction mechanism, and random(0-0.1) represents a random value between 0 and 0.1.

[0052] To visually represent the warning risk levels of each inspection indicator in a multi-branch tree, different colors can be used to represent different warning risk levels. For example, green can be set for adjusted result values ​​in the range [0, 0.5); yellow for values ​​in the range [0.5, 1); and red for values ​​greater than or equal to 1.

[0053] S104: Based on the established early warning rules, conduct a comprehensive analysis of the second inspection results corresponding to each inspection indicator to determine the early warning result.

[0054] Before an operating system actually malfunctions, there are often some abnormal indicators. Considering that the test results of a single indicator may not fully reflect the abnormal situation of the operating system, the second test results corresponding to each indicator can be comprehensively analyzed according to the set early warning rules.

[0055] During comprehensive analysis, only indicators with high risk levels can be analyzed. Based on the warning risk levels included in the second inspection results, a set of inspection indicators that meet the warning risk level requirements can be selected from various inspection indicators.

[0056] For example, you can filter out the inspection indicators that are set to red.

[0057] The system determines whether a target indicator combination matching the inspection indicator set exists in the early warning database; the early warning database contains security events corresponding to different indicator combinations. If a target indicator combination matching the inspection indicator set exists in the early warning database, the security event corresponding to the target indicator combination is used as the early warning result.

[0058] For example, a Trojan virus opens a port (item 5), releases a self-process (with a special username, item 7), and frantically creates or modifies files in the system directory (item 9), consuming a very high amount of processor resources (item 1). Of the 20 user-mode checks, items 1, 5, 7, and 9 are red, indicating a Trojan attack risk on the operating system. For instance, items 1, 3, 5, and 8 being red together suggest a cryptocurrency mining virus attack. Similarly, items 2, 4, 7, and 15 being red together suggest a myocardial hemorrhage attack.

[0059] After determining the warning result, the warning result can be fed back to the root node of the multi-way tree, and the matching process of other subtrees in the multi-way tree can be stopped.

[0060] In this embodiment of the application, multiple subtrees can be matched in parallel and the results are fed back to the root node. Furthermore, there is a linkage between sibling subtrees. If some subtrees have completed the matching, it means that the warning result has been identified. Then, other subtrees are notified to stop matching immediately and report the warning result.

[0061] As can be seen from the above technical solution, the various inspection indicators of the operating system are obtained; based on the matching position of the target inspection indicator in the multi-branch tree, the first inspection result of the target inspection indicator is determined; where the target inspection indicator is any one of the various inspection indicators. The multi-branch tree contains multiple layers of branches: the first layer is the root node, the second layer contains position nodes, the third layer contains the inspection items corresponding to each position node, the fourth layer contains the initial inspection conditions corresponding to each inspection item, and the fifth layer contains the error correction conditions corresponding to each first inspection result. Parallel processing of various inspection indicators can be achieved by using the multi-branch tree matching method, improving inspection efficiency. Furthermore, error correction conditions are set at the fifth layer of the multi-branch tree. Based on the error correction conditions corresponding to the first inspection result, the target inspection indicator is analyzed to determine the second inspection result of the target inspection indicator, ensuring the accuracy of the second inspection result. Before a real problem occurs in the operating system, there are often some abnormal indicators. Considering that the detection result corresponding to a single inspection indicator may not fully reflect the abnormal situation of the operating system, the second inspection results corresponding to each inspection indicator can be comprehensively analyzed according to the set early warning rules to determine the early warning result. This technical solution utilizes a built-in multi-branch tree for depth-first search, ensuring accuracy while enabling parallel processing of various inspection indicators, thus improving efficiency. The built-in multi-branch tree and the matching of inspection indicators based on it do not consume excessive system resources, allowing for operating system health checks with minimal performance and resource consumption. Furthermore, comprehensive analysis of all detection results allows for timely detection of operating system anomalies, providing early warnings before problems actually occur, thereby enhancing operating system security.

[0062] After taking the security events corresponding to the target indicator combination as the warning results, the warning results can be fed back to the user terminal; if no response information is received within the set time, the warning operation corresponding to the security event will be executed.

[0063] Considering that in practical applications, there may be situations where the early warning database does not contain a combination of target indicators that matches the set of inspection indicators, the current level of danger of the operating system can be assessed by calculating a risk value.

[0064] In practical implementation, a set of weights matching the business scenario can be obtained; this set contains the weights corresponding to each inspection item in the business scenario. All inspection indicators are then weighted and summed based on the weight set to obtain a risk value; and the corresponding danger level is then fed back to the user terminal.

[0065] The weights in the weight set can be defined based on the system type and the importance of the inspection items. As the system type and the importance of the inspection items change, the weights can be dynamically adjusted to ensure the rationality of the weight settings.

[0066] The higher the risk value, the higher the corresponding hazard level. In the embodiments of this application, the hazard levels corresponding to different risk value ranges can be pre-defined.

[0067] For example, the hazard level can be divided into four levels, which are numbered from the lowest to the highest as the first hazard level to the fourth hazard level. The risk value range corresponding to the first hazard level is [0, 50]; the risk value range corresponding to the first danger level is (50, 60]; the risk value range corresponding to the first danger level is (60, 80]; and the risk value range corresponding to the first danger level is (80, 100).

[0068] The first level of danger is a warning; the second level of danger is danger; the third level of danger is high risk; and the fourth level of danger is suspected attack.

[0069] In this embodiment, when no security event can be matched, the risk value of the operating system is determined by quantitatively evaluating all inspection indicators based on a weight set matched to the business scenario, thus quantifying and locating potential risks. To help users understand the degree of danger more intuitively, the risk value can be converted into a danger level. Different countermeasures can be taken based on different danger levels.

[0070] Figure 3 A flowchart illustrating a method for determining the target location of a target inspection index in a multi-branch tree, provided in this application embodiment, includes:

[0071] S301: When the target inspection metrics are collected in the kernel memory area, the target inspection metrics are jumped from the root node of the multi-way tree to the kernel state node of the second layer.

[0072] The first level of the multi-branch tree is the root node, which is the entry point for inputting various inspection indicators. The root node can distinguish between the application layer and the kernel layer based on the current indicator collection location, and choose whether to match the user space or the kernel space next.

[0073] S302: When the target inspection indicator is collected in the user memory area, jump the target inspection indicator from the root node of the multi-way tree to the user-mode node of the second level.

[0074] S303: Extract the identification information contained in the target inspection indicators; match the identification information with each inspection item contained under the target location in the multi-branch tree to jump to the target inspection item at the third level.

[0075] S304: Determine whether the target inspection indicator is a numerical indicator.

[0076] When the target inspection indicator is a numerical indicator, the next node to be entered can be determined by calculating the degree of deviation between the target inspection indicator and the upper limit value, that is, executing S305.

[0077] If the target inspection indicator is not a numerical indicator, the next node to proceed to can be determined by comparing the degree of matching between the target inspection indicator and the project information of the inspection item under normal conditions, i.e., executing S308.

[0078] S305: Divide the value of the target inspection item by the upper limit of its corresponding threshold condition to obtain the quotient.

[0079] The quotient reflects the degree of deviation of the target check item from the upper limit value. Under normal circumstances, the value of the target check item should be within the upper limit value included in the threshold condition, so the quotient should be less than one. If the quotient is greater than or equal to one, it means that the target check item has deviated from the upper limit value. The larger the quotient, the greater the degree of deviation, indicating that the target check item is in an abnormal state.

[0080] S306: If the quotient is less than one, jump from the target check item of the multi-branch tree to the normal branch node of the fourth level.

[0081] If the quotient is less than one, it means that the value of the target check item is within the upper limit of the threshold condition, that is, the target check item is in a normal state. At this time, you can jump from the target check item of the multi-branch tree to the normal branch node of the fourth level.

[0082] S307: If the quotient is greater than or equal to one, jump from the target check item of the multi-branch tree to the abnormal branch node of the fourth level.

[0083] If the quotient is greater than or equal to one, it means that the target check item has deviated from the upper limit value, that is, the target check item is in an abnormal state. At this time, you can jump from the target check item in the multi-branch tree to the abnormal branch node of the fourth level.

[0084] S308: Determine whether the target inspection indicators match the project information corresponding to the target inspection items.

[0085] If the target inspection indicator is not a numerical indicator, it can be determined whether the target inspection indicator matches the project information corresponding to the target inspection item.

[0086] If the target inspection indicator matches the corresponding item information, proceed to step S309. If the target inspection indicator does not match the corresponding item information, proceed to step S310.

[0087] S309: Jump from the target check item of the multi-branch tree to the normal branch node of the fourth level.

[0088] If the target inspection indicator matches the corresponding project information, it means that the target inspection indicator is in a normal state. At this time, you can jump from the target inspection item in the multi-branch tree to the normal branch node of the fourth level.

[0089] S310: Jump from the target check item of the multi-branch tree to the abnormal branch node of the fourth level.

[0090] If the target inspection indicator does not match the corresponding project information, it indicates that the target inspection indicator is abnormal. At this time, you can jump from the target inspection item in the multi-branch tree to the abnormal branch node of the fourth level.

[0091] In this embodiment, the collected numerical indicators are digitized to select a subtree; the collected non-numerical indicators are matched to select a subtree. This ensures the smooth search of various inspection indicators. Based on the deep search of various indicators using a multi-branch tree, risky behaviors can be automatically identified, reducing the risks caused by human operation in the data center.

[0092] After determining the first inspection result of the target inspection indicator based on the threshold conditions corresponding to the target inspection item, the target inspection indicator of the normal branch node that jumps to the fourth layer can be stored in the waiting area; the target inspection indicator of the abnormal branch node that jumps to the fourth layer can be stored in the risk area.

[0093] By partitioning and storing the target inspection metrics for normal and abnormal branch nodes, it is easier to retrieve data on demand. When only the inspection metrics for abnormal branch nodes are needed, they can be retrieved directly from the risk zone.

[0094] Figure 4 A schematic diagram of an operating system inspection device provided in an embodiment of this application includes an acquisition unit 41, a determination unit 42, a correction unit 43, and an analysis unit 44;

[0095] Acquisition unit 41 is used to acquire various inspection indicators of the operating system;

[0096] The determining unit 42 is used to determine the first inspection result of the target inspection indicator based on the matching position of the target inspection indicator in the multi-branch tree; wherein, the target inspection indicator is any one of the inspection indicators; the multi-branch tree contains multiple layers of branches, the first layer is the root node, the second layer contains position nodes, the third layer contains the inspection items corresponding to each position node, the fourth layer contains the initial inspection conditions corresponding to each inspection item, and the fifth layer contains the error correction conditions corresponding to each first inspection result.

[0097] The correction unit 43 is used to analyze the target inspection index based on the error correction conditions corresponding to the first inspection result, so as to determine the second inspection result of the target inspection index.

[0098] Analysis unit 44 is used to comprehensively analyze the second inspection results corresponding to each inspection indicator according to the set early warning rules, so as to determine the early warning result.

[0099] In some embodiments, the correction unit includes an adjustment subunit and a comparison subunit;

[0100] The adjustment subunit is used to adjust the result value contained in the first inspection result according to the correction coefficient corresponding to the first inspection result, so as to obtain the adjusted result value.

[0101] The comparison sub-unit is used to compare the adjusted result value with multiple set partition ranges to determine the warning risk level matched by the adjusted percentage value; wherein, each partition range has its own corresponding warning risk level.

[0102] In some embodiments, the analysis unit includes a filtering subunit, a judgment subunit, and an as-subunit;

[0103] The filtering subunit is used to filter out a set of inspection indicators that meet the warning risk level requirements from various inspection indicators based on the warning risk level contained in the second inspection result.

[0104] The judgment subunit is used to determine whether there is a target indicator combination in the early warning database that matches the inspection indicator set; wherein, the early warning database contains security events corresponding to different indicator combinations;

[0105] As a sub-unit, it is used to take the security event corresponding to the target indicator combination as the warning result when there is a target indicator combination in the warning database that matches the inspection indicator set.

[0106] In some embodiments, a feedback unit and an execution unit are also included;

[0107] The feedback unit is used to send the warning results back to the user terminal;

[0108] The execution unit is used to perform early warning operations corresponding to security events if no response information is received within a set time.

[0109] In some embodiments, the system further includes a weight acquisition unit and a summation unit;

[0110] The weight acquisition unit is used to acquire a weight set that matches the business scenario when there is no target indicator combination in the early warning library that matches the inspection indicator set; the weight set contains the weights corresponding to each inspection item in the business scenario;

[0111] The summation unit is used to perform a weighted summation of all inspection indicators based on the weight set to obtain the risk value; and to feed back the hazard level matching the risk value to the user terminal.

[0112] In some embodiments, the determining unit includes a location determining subunit, an inspection item determining subunit, and a result determining subunit;

[0113] The location determination subunit is used to determine the target location of the target inspection indicator in the multi-branch tree based on the collection location of the target inspection indicator;

[0114] The inspection item determination sub-unit is used to compare the target inspection index with each inspection item contained under the target location in order to determine the target inspection item that matches the target inspection index.

[0115] The result determination subunit is used to determine the first inspection result of the target inspection index based on the threshold conditions corresponding to the target inspection item.

[0116] In some embodiments, the location determination subunit is used to jump from the root node of the multi-way tree to the kernel state node of the second layer when the collection location of the target inspection indicator is the kernel memory area.

[0117] When the target inspection metrics are collected in the user memory area, the target inspection metrics are jumped from the root node of the multi-branch tree to the user-space node of the second level.

[0118] In some embodiments, the inspection item determination subunit is used to extract the identification information contained in the target inspection indicator;

[0119] The identification information is matched with the check items contained under the target location in the multi-branch tree to jump to the target check item at the third level.

[0120] In some embodiments, the result determination subunit is used to divide the value of the target inspection item by the upper limit of its corresponding threshold condition to obtain a quotient when the target inspection indicator is a numerical indicator.

[0121] If the quotient is less than one, jump from the target check item of the multi-branch tree to the normal branch node of the fourth level;

[0122] If the quotient is greater than or equal to one, jump from the target check item of the multi-branch tree to the abnormal branch node of the fourth level;

[0123] If the target inspection indicator is not a numerical indicator, determine whether the target inspection indicator matches the project information corresponding to the target inspection item;

[0124] When the target inspection indicator matches the project information corresponding to the target inspection item, jump from the target inspection item in the multi-branch tree to the normal branch node of the fourth level.

[0125] If the target inspection indicator does not match the project information corresponding to the target inspection item, jump from the target inspection item in the multi-branch tree to the abnormal branch node in the fourth level.

[0126] In some embodiments, a storage unit is also included;

[0127] The storage unit is used to store the target inspection indicators of normal branch nodes that jump to the fourth level into the waiting area; and to store the target inspection indicators of abnormal branch nodes that jump to the fourth level into the risk area.

[0128] In some embodiments, after comprehensively analyzing the second inspection results corresponding to each inspection indicator according to the set warning rules to determine the warning result, a stop unit is also included.

[0129] The stop unit is used to feed back the warning result to the root node of the multi-branch tree and stop the matching process of other subtrees in the multi-branch tree.

[0130] As can be seen from the above technical solution, the various inspection indicators of the operating system are obtained; based on the matching position of the target inspection indicator in the multi-branch tree, the first inspection result of the target inspection indicator is determined; where the target inspection indicator is any one of the various inspection indicators. The multi-branch tree contains multiple layers of branches: the first layer is the root node, the second layer contains position nodes, the third layer contains the inspection items corresponding to each position node, the fourth layer contains the initial inspection conditions corresponding to each inspection item, and the fifth layer contains the error correction conditions corresponding to each first inspection result. Parallel processing of various inspection indicators can be achieved by using the multi-branch tree matching method, improving inspection efficiency. Furthermore, error correction conditions are set at the fifth layer of the multi-branch tree. Based on the error correction conditions corresponding to the first inspection result, the target inspection indicator is analyzed to determine the second inspection result of the target inspection indicator, ensuring the accuracy of the second inspection result. Before a real problem occurs in the operating system, there are often some abnormal indicators. Considering that the detection result corresponding to a single inspection indicator may not fully reflect the abnormal situation of the operating system, the second inspection results corresponding to each inspection indicator can be comprehensively analyzed according to the set early warning rules to determine the early warning result. This technical solution utilizes a built-in multi-branch tree for depth-first search, ensuring accuracy while enabling parallel processing of various inspection indicators, thus improving efficiency. The built-in multi-branch tree and the matching of inspection indicators based on it do not consume excessive system resources, allowing for operating system health checks with minimal performance and resource consumption. Furthermore, comprehensive analysis of all detection results allows for timely detection of operating system anomalies, providing early warnings before problems actually occur, thereby enhancing operating system security.

[0131] For a description of the features in the embodiment corresponding to the operating system checking device, please refer to the relevant description of the embodiment corresponding to the operating system checking method, which will not be repeated here.

[0132] Embodiments of this application also provide an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to perform the steps in any of the above-described operating system checking method embodiments.

[0133] Embodiments of this application also provide a computer-readable storage medium storing a computer program, wherein the computer program is configured to execute the steps in any of the above-described operating system checking method embodiments when it runs.

[0134] In one exemplary embodiment, the aforementioned computer-readable storage medium may include, but is not limited to, various media capable of storing computer programs, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard disk, magnetic disk, or optical disk.

[0135] Embodiments of this application also provide a computer program product, which includes a computer program that, when executed by a processor, implements the steps in any of the above-described operating system inspection method embodiments.

[0136] Embodiments of this application also provide another computer program product, including a non-volatile computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps in any of the above-described operating system checking method embodiments.

[0137] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0138] The above provides a detailed description of an operating system inspection method, apparatus, device, storage medium, and product provided in this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the embodiments above are only intended to help understand the method and core ideas of this application. It should be noted that those skilled in the art can make various improvements and modifications to this application without departing from its principles, and these improvements and modifications also fall within the protection scope of this application.

Claims

1. An operating system inspection method, characterized in that, include: Obtain various check indicators of the operating system; Based on the matching position of the target inspection indicator in the multi-branch tree, the first inspection result of the target inspection indicator is determined; wherein, the target inspection indicator is any one of the inspection indicators; the multi-branch tree contains multiple layers of branches, the first layer is the root node, the second layer contains position nodes, the third layer contains the inspection items corresponding to each position node, the fourth layer contains the initial inspection conditions corresponding to each inspection item, and the fifth layer contains the error correction conditions corresponding to each first inspection result. Based on the error correction conditions corresponding to the first inspection result, the target inspection index is analyzed to determine the second inspection result of the target inspection index; The second inspection results corresponding to each inspection indicator are comprehensively analyzed according to the established early warning rules to determine the early warning result. Based on the matching position of the target inspection indicator in the multi-way tree, the first inspection result of the target inspection indicator is determined, including: Based on the collection location of the target inspection indicator, the target position of the target inspection indicator in the multi-branch tree is determined; The target inspection index is compared with each inspection item contained under the target location to determine the target inspection item that matches the target inspection index. Based on the threshold conditions corresponding to the target inspection item, the first inspection result of the target inspection indicator is determined.

2. The operating system inspection method according to claim 1, characterized in that, Based on the error correction conditions corresponding to the first inspection result, the target inspection index is analyzed to determine the second inspection result of the target inspection index, including: According to the correction coefficient corresponding to the first inspection result, the result value contained in the first inspection result is adjusted to obtain the adjusted result value; The adjusted result value is compared with multiple set partition ranges to determine the warning risk level matched by the adjusted percentage value; each partition range has its own corresponding warning risk level.

3. The operating system inspection method according to claim 2, characterized in that, According to the established early warning rules, the second inspection results corresponding to each inspection indicator are comprehensively analyzed to determine the early warning results, including: Based on the warning risk levels included in the second inspection results, a set of inspection indicators that meet the warning risk level requirements are selected from all inspection indicators. Determine whether there is a target indicator combination in the early warning database that matches the set of inspection indicators; wherein, the early warning database contains security events corresponding to different indicator combinations; If a combination of target indicators that matches the set of inspection indicators exists in the warning database, the security event corresponding to the combination of target indicators will be used as the warning result.

4. The operating system inspection method according to claim 3, characterized in that, After using the security events corresponding to the combination of the target indicators as the early warning results, the system also includes: The warning results are then fed back to the user terminal. If no response is received within the set time, the warning operation corresponding to the security event will be executed.

5. The operating system inspection method according to claim 3, characterized in that, Also includes: If no target indicator combination matching the inspection indicator set exists in the warning database, a weight set matching the business scenario is obtained; wherein, the weight set contains the weights corresponding to each inspection item in the business scenario; The risk value is obtained by weighting and summing all inspection indicators according to the weight set, and the danger level matching the risk value is fed back to the user terminal.

6. The operating system inspection method according to claim 1, characterized in that, Based on the collection location of the target inspection indicator, the target position of the target inspection indicator in the multi-branch tree is determined, including: If the target inspection indicator is collected in the kernel memory area, the target inspection indicator is jumped from the root node of the multi-way tree to the kernel state node of the second layer. If the target inspection indicator is collected in the user memory area, the target inspection indicator is jumped from the root node of the multi-way tree to the user-mode node of the second layer.

7. The operating system inspection method according to claim 1, characterized in that, The target inspection index is compared with each inspection item included under the target location to determine the target inspection item that matches the target inspection index, including: Extract the identification information contained in the target inspection indicators; The identification information is matched with each check item contained under the target location in the multi-branch tree to jump to the target check item in the third layer.

8. The operating system inspection method according to claim 1, characterized in that, Based on the threshold conditions corresponding to the target inspection item, the first inspection result of the target inspection indicator is determined, including: When the target inspection indicator is a numerical indicator, the value of the target inspection item is divided by the upper limit of its corresponding threshold condition to obtain the quotient. If the quotient is less than one, jump from the target check item of the multi-branch tree to the normal branch node of the fourth level; If the quotient is greater than or equal to one, jump from the target check item of the multi-branch tree to the abnormal branch node of the fourth level; If the target inspection indicator is not a numerical indicator, determine whether the target inspection indicator matches the project information corresponding to the target inspection item; If the target inspection indicator matches the item information corresponding to the target inspection item, jump from the target inspection item of the multi-branch tree to the normal branch node of the fourth level. If the target inspection index does not match the project information corresponding to the target inspection item, jump from the target inspection item of the multi-branch tree to the abnormal branch node of the fourth layer.

9. The operating system inspection method according to claim 8, characterized in that, After determining the first inspection result of the target inspection indicator based on the threshold condition corresponding to the target inspection item, the method further includes: Store the target inspection metrics for the normal branch node that jumps to the fourth level into the waiting area; Store the target inspection metrics of the abnormal branch node that jumps to the fourth level in the risk area.

10. The operating system checking method according to any one of claims 1 to 9, characterized in that, After comprehensively analyzing the second inspection results corresponding to each inspection indicator according to the established early warning rules to determine the early warning result, the following is also included: The warning result is fed back to the root node of the multi-branch tree, and the matching process of other subtrees in the multi-branch tree is stopped.

11. An operating system checking device, characterized in that, It includes an acquisition unit, a determination unit, a correction unit, and an analysis unit; The acquisition unit is used to acquire various inspection indicators of the operating system; The determining unit is used to determine the first inspection result of the target inspection indicator based on the matching position of the target inspection indicator in the multi-branch tree; wherein the target inspection indicator is any one of the various inspection indicators; the multi-branch tree contains multiple layers of branches, the first layer is the root node, the second layer contains position nodes, the third layer contains the inspection items corresponding to each position node, the fourth layer contains the initial inspection conditions corresponding to each inspection item, and the fifth layer contains the error correction conditions corresponding to each first inspection result. The correction unit is used to analyze the target inspection index based on the error correction conditions corresponding to the first inspection result, so as to determine the second inspection result of the target inspection index. The analysis unit is used to comprehensively analyze the second inspection results corresponding to each inspection indicator according to the set early warning rules, so as to determine the early warning result. The determination unit includes a location determination subunit, an inspection item determination subunit, and a result determination subunit; The location determination subunit is used to determine the target location of the target inspection indicator in the multi-branch tree based on the collection location of the target inspection indicator; The inspection item determination sub-unit is used to compare the target inspection index with each inspection item contained under the target location in order to determine the target inspection item that matches the target inspection index. The result determination subunit is used to determine the first inspection result of the target inspection index based on the threshold conditions corresponding to the target inspection item.

12. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the steps of the operating system checking method as described in any one of claims 1 to 10 when executing the computer program.

13. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, wherein the computer program, when executed by a processor, implements the steps of the operating system inspection method as described in any one of claims 1 to 10.

14. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the operating system inspection method as described in any one of claims 1 to 10.

Images