Data center intelligent monitoring method and system

Abstract

The invention provides a data center intelligent monitoring method and system, and relates to the field of data center safety monitoring, and the method comprises the steps: obtaining and decoupling a multi-source perception data stream, and extracting a behavior feature sequence and a scene feature sequence; constructing an intention state transition model to identify an intermediate intention state in an attack preparation stage; calculating a semantic deviation degree and constructing a causal reasoning chain; identifying an attack starting point and a propagation path; and determining an isolation range and a blocking opportunity. The method can achieve the early recognition and precise tracing of the attack behavior, and improves the safety protection capability of a data center.

Description

TECHNICAL FIELD

[0001] The present application relates to data center security monitoring technology, and in particular to a data center intelligent monitoring method and system. BACKGROUND

[0002] With the continuous growth of data center scale and complexity, data center security monitoring has become a key link to ensure the stable operation of information infrastructure. Traditional data center monitoring methods mainly rely on rule-based anomaly detection and simple threshold alarm mechanisms, which lack effective identification and early warning capabilities for complex security threats. In recent years, with the development of Internet of Things technology, video analysis technology and artificial intelligence technology, data center intelligent monitoring systems have begun to integrate multi-source perception data to achieve comprehensive perception and analysis of data center environments. Currently, intelligent monitoring systems mainly deploy various sensors, cameras and other devices to collect multi-dimensional data such as temperature and humidity, energy consumption, and personnel activity, and through data fusion and intelligent analysis technology, identify abnormal behavior and potential security threats.

[0003] Existing monitoring systems mostly focus on detecting abnormal events that have already occurred, lack effective identification capabilities for intermediate intent states during the attack preparation phase, and thus cannot effectively warn before security events occur. Behavior characteristics and scene characteristics are usually analyzed separately, lacking in-depth mining of their temporal correlation, making it difficult to accurately determine the semantic deviation of behavior in a specific scene, resulting in a large number of false positives or false negatives. After anomaly detection, there is usually a lack of effective traceability analysis mechanism, which cannot identify the starting point and propagation path of the attack, resulting in insufficient targeting of security response measures, inability to achieve precise isolation and timely blocking, and increased complexity and time cost of security event handling. SUMMARY

[0004] The present application provides a data center intelligent monitoring method and system, which can solve the problems in the prior art.

[0005] In a first aspect of the present application, a data center intelligent monitoring method is provided, comprising:

[0006] Obtaining multi-source perception data streams in a controlled area of a data center and decoupling in space-time dimensions, extracting behavior feature sequences and scene feature sequences of target objects;

[0007] Based on the evolution track of the behavior feature sequence within a preset time window, an intent state transition model is constructed, which maps discrete behavior features in the behavior feature sequence to a continuous intent space, identifies intermediate intent states during the attack preparation phase, and obtains an intent evolution chain;

[0008] The intent evolution chain is temporally aligned with the scene feature sequence, the semantic deviation is calculated, and for target objects whose semantic deviation exceeds the preset deviation range, the behavior nodes that trigger intermediate intent state transitions are traced back in the intent evolution chain to construct a causal reasoning chain.

[0009] Calculate the contribution of each behavioral node in the causal inference chain to the final abnormal state, identify the attack starting point and propagation path, and obtain the source tracing results;

[0010] Based on the location of the attack origin and the number of behavioral nodes in the causal reasoning chain in the tracing results, the isolation range and blocking timing are determined, and early warning control instructions are generated.

[0011] Acquire multi-source sensing data streams within a controlled area of ​​the data center and decouple them in terms of spatiotemporal dimensions. Extract behavioral feature sequences and scene feature sequences of the target objects, including:

[0012] Multi-source sensing data streams are obtained from distributed sensing nodes within the controlled area of ​​the data center. These multi-source sensing data streams include spatial monitoring information streams and access behavior information streams.

[0013] The time reference of data records in the spatial monitoring information flow and access behavior information flow is unified, and a unified timestamp is marked for each data record to obtain a time-aligned multi-source sensing data flow;

[0014] Based on the time-aligned multi-source sensing data stream, physical location change events in the spatial monitoring information stream and resource access operation events in the access behavior information stream are extracted.

[0015] The timing deviation between physical location change events and resource access operation events is detected, asynchronous behavior segments whose timing deviation exceeds a preset synchronization window are identified, and the timing is arranged to construct a sequence of behavior features.

[0016] For asynchronous behavior segments in the behavior feature sequence, extract the spatial security domain identifier and the logical permission domain identifier, calculate the coupling degree between the spatial security domain identifier and the logical permission domain identifier, identify scene abnormal patterns with coupling degree lower than a preset coupling threshold, and construct a scene feature sequence containing scene abnormal patterns.

[0017] Based on the evolution trajectory of behavioral feature sequences within a preset time window, the intention state transition model is constructed as follows:

[0018] The behavioral feature sequence is segmented according to a preset time window to obtain multiple time window segments, each of which contains a behavioral feature subsequence within the corresponding time period.

[0019] Temporal encoding is performed on the behavioral feature subsequences within each time window segment to extract the evolution patterns of the behavioral feature subsequences. Based on the evolution patterns of each time window segment, the behavioral evolution trajectory is constructed.

[0020] The behavior evolution trajectory is divided into state spaces, and the evolution patterns in the behavior evolution trajectory are mapped to discrete intention state nodes. The transition relationship between intention state nodes between adjacent time window segments is identified, and the transition relationship includes the state transition direction and the state transition probability.

[0021] Based on the identified transition relationships, an intention state transition model is constructed. The intention state transition model includes multiple intention state nodes and state transition paths connecting the intention state nodes. The state transition paths record the intention evolution pattern of the behavioral feature sequence within a preset time window.

[0022] The intent state transition model maps discrete behavioral features in a behavioral feature sequence to a continuous intent space, identifies intermediate intent states during the attack preparation phase, and obtains an intent evolution chain including:

[0023] Extract the intent state nodes from the intent state transition model, and semantically encode the evolution patterns of the intent state nodes to obtain semantic anchor vectors.

[0024] A continuous intent space is constructed based on semantic anchor vectors. A preparation intent region is divided in the continuous intent space by the state transition path in the intent state transition model. The preparation intent region corresponds to the transition path from the normal state node to the attack state node.

[0025] Semantic encoding is performed on discrete behavioral features in the behavioral feature sequence to obtain the current semantic vector. The vector distance between the current semantic vector and the semantic anchor vector is calculated, and the current semantic vector is mapped to the continuous intent space.

[0026] Identify the current semantic vector mapped to the preparation intent region, and determine whether the discrete behavioral features corresponding to the current semantic vector are located on the transition path from the normal state node to the attack state node based on the state transition path, and mark it as an intermediate intent state in the attack preparation stage.

[0027] By connecting the initial intention state node, intermediate intention state, and current intention state node along the state transition path, an intention evolution chain is constructed.

[0028] The intent evolution chain is temporally aligned with the scene feature sequence, and the semantic deviation is calculated. For target objects whose semantic deviation exceeds a preset deviation range, the behavior nodes that trigger intermediate intent state transitions are traced back in the intent evolution chain to construct a causal reasoning chain, including:

[0029] Align the intermediate intent states in the intent evolution chain with the scene feature segments in the scene feature sequence by timestamp, extract the evolution direction vector of the intermediate intent state and the evolution direction vector of the scene feature segment, and calculate the angle between the vectors to obtain the semantic deviation.

[0030] Construct a temporal variation curve of semantic deviation, identify the turning point on the temporal variation curve where the semantic deviation changes from not exceeding the preset deviation range to exceeding the preset deviation range, and extract the time corresponding to the turning point as the deviation trigger time.

[0031] Locate the intermediate intention state node that deviates from the trigger time in the intention evolution chain, trace back along the state transition path to the intermediate intention state node before the deviating from the trigger time, extract the behavior node between the two intermediate intention state nodes as the trigger behavior node, and calculate the state transition probability increment caused by the trigger behavior node.

[0032] Based on the state transition probability increment, the triggering behavior node and the predecessor behavior node are causally weighted to construct a causal reasoning chain.

[0033] Calculate the contribution of each behavioral node in the causal inference chain to the final abnormal state, identify the attack initiation point and propagation path, and obtain the following tracing results:

[0034] Extract the state transition probability increments caused by each behavioral node in the causal inference chain, and accumulate the state transition probability increments along the causal association direction of the causal inference chain to obtain the cumulative contribution of each behavioral node to the final abnormal state.

[0035] The cumulative contribution of each behavioral node in the causal reasoning chain is calculated by reverse difference. The behavioral nodes whose cumulative contribution changes from zero to non-zero by reverse difference are marked as the attack starting point.

[0036] Extract the sequence of behavioral nodes with monotonically increasing cumulative contribution from the attack starting point along the causal relationship direction. Calculate the increment ratio between adjacent nodes for the cumulative contribution of each behavioral node in the sequence. Identify the behavioral nodes with accelerating cumulative contribution as propagation acceleration nodes based on the increment ratio. Combine the attack starting point, propagation acceleration nodes, and their connected behavioral node sequences to form a propagation path.

[0037] The attack origin and propagation path are combined to form the source tracing result.

[0038] Based on the attack origination point location and the number of behavioral nodes in the causal inference chain in the tracing results, the isolation range and blocking timing are determined, and early warning control instructions are generated, including:

[0039] Extract the position index of the attack starting point in the causal reasoning chain, and count the number of behavioral nodes from the attack starting point to the final abnormal state.

[0040] Construct a causal influence domain centered on the attack initiation point, calculate the causal correlation strength attenuation coefficient between each behavioral node in the causal inference chain and the attack initiation point, include behavioral nodes whose causal correlation strength attenuation coefficient is greater than the attenuation threshold into the causal influence domain, and determine the causal influence domain as the isolation range.

[0041] Extract the state transition time interval of each behavior node within the isolation range, construct the state transition time series, perform time series prediction on the state transition time series to obtain the boundary arrival time of the attack reaching the boundary of the isolation range, and subtract the preset lead time from the boundary arrival time to determine the blocking timing.

[0042] The isolation range and blocking timing are encapsulated to generate early warning and control commands.

[0043] A second aspect of the present invention provides a data center intelligent monitoring system, comprising:

[0044] The first unit is used to acquire multi-source sensing data streams within the controlled area of ​​the data center and decouple them in the spatiotemporal dimension, and extract the behavioral feature sequence and scene feature sequence of the target object;

[0045] The second unit is used to construct an intent state transition model based on the evolution trajectory of the behavioral feature sequence within a preset time window. The intent state transition model maps discrete behavioral features in the behavioral feature sequence to a continuous intent space, identifies intermediate intent states in the attack preparation phase, and obtains the intent evolution chain.

[0046] The third unit is used to align the intent evolution chain with the scene feature sequence in time, calculate the semantic deviation, and for target objects whose semantic deviation exceeds the preset deviation range, trace back the behavior node that triggers the intermediate intent state transition in the intent evolution chain to construct a causal reasoning chain.

[0047] The fourth unit is used to calculate the contribution of each behavioral node in the causal inference chain to the final abnormal state, identify the attack starting point and propagation path, and obtain the source tracing results.

[0048] The fifth unit is used to determine the isolation range and blocking timing based on the location of the attack starting point and the number of behavioral nodes in the causal reasoning chain in the tracing results, and to generate early warning and control instructions.

[0049] A third aspect of the present invention provides an electronic device, comprising:

[0050] processor;

[0051] Memory used to store processor-executable instructions;

[0052] The processor is configured to invoke instructions stored in the memory to execute the aforementioned method.

[0053] A fourth aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0054] In this embodiment, by decoupling the analysis of multi-source perception data streams across spatiotemporal dimensions, an intent state transition model is constructed, enabling early identification of intermediate intent states during the attack preparation phase and improving the foresight and accuracy of threat detection. Through temporal alignment and semantic deviation calculation of the intent evolution chain and scene feature sequences, combined with the construction of a causal inference chain, the attack initiation point and propagation path can be accurately identified, achieving effective attribution of data center security incidents and enhancing the interpretability of security analysis. Based on the attribution results, the isolation scope and blocking timing are dynamically determined, generating precise early warning and control commands, reducing false alarm and false negative rates, improving the intelligence level of data center security protection and its ability to cope with complex attacks, while simultaneously reducing unnecessary business interruptions. Attached Figure Description

[0055] Figure 1 This is a flowchart illustrating the intelligent monitoring method for data centers according to an embodiment of the present invention;

[0056] Figure 2 This is a flowchart illustrating the attack tracing operation in an embodiment of the present invention. Detailed Implementation

[0057] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0058] The technical solution of the present invention will be described in detail below with reference to specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0059] Figure 1 This is a flowchart illustrating the intelligent data center monitoring method according to an embodiment of the present invention, as shown below. Figure 1 As shown, the method includes:

[0060] Acquire multi-source sensing data streams within the controlled area of ​​the data center and decouple them in terms of spatiotemporal dimensions to extract the behavioral feature sequences and scene feature sequences of the target objects;

[0061] Based on the evolution trajectory of the behavioral feature sequence within a preset time window, an intent state transition model is constructed. The intent state transition model maps discrete behavioral features in the behavioral feature sequence to a continuous intent space, identifies intermediate intent states in the attack preparation phase, and obtains the intent evolution chain.

[0062] The intent evolution chain is temporally aligned with the scene feature sequence, the semantic deviation is calculated, and for target objects whose semantic deviation exceeds the preset deviation range, the behavior nodes that trigger intermediate intent state transitions are traced back in the intent evolution chain to construct a causal reasoning chain.

[0063] Calculate the contribution of each behavioral node in the causal inference chain to the final abnormal state, identify the attack starting point and propagation path, and obtain the source tracing results;

[0064] Based on the location of the attack origin and the number of behavioral nodes in the causal reasoning chain in the tracing results, the isolation range and blocking timing are determined, and early warning control instructions are generated.

[0065] In one optional implementation, acquiring multi-source sensing data streams within a controlled area of ​​the data center and decoupling them in terms of spatiotemporal dimensions, and extracting behavioral feature sequences and scene feature sequences of the target object, including:

[0066] Multi-source sensing data streams are obtained from distributed sensing nodes within the controlled area of ​​the data center. These multi-source sensing data streams include spatial monitoring information streams and access behavior information streams.

[0067] The time reference of data records in the spatial monitoring information flow and access behavior information flow is unified, and a unified timestamp is marked for each data record to obtain a time-aligned multi-source sensing data flow;

[0068] Based on the time-aligned multi-source sensing data stream, physical location change events in the spatial monitoring information stream and resource access operation events in the access behavior information stream are extracted.

[0069] The timing deviation between physical location change events and resource access operation events is detected, asynchronous behavior segments whose timing deviation exceeds a preset synchronization window are identified, and the timing is arranged to construct a sequence of behavior features.

[0070] For asynchronous behavior segments in the behavior feature sequence, extract the spatial security domain identifier and the logical permission domain identifier, calculate the coupling degree between the spatial security domain identifier and the logical permission domain identifier, identify scene abnormal patterns with coupling degree lower than a preset coupling threshold, and construct a scene feature sequence containing scene abnormal patterns.

[0071] In actual implementation, various sensing devices are deployed within the controlled area of ​​the data center, including video surveillance cameras, intelligent access control systems, infrared thermal detectors, and network resource access logging systems. These devices constitute a distributed sensing node network, continuously collecting and outputting multi-source sensing data streams. These multi-source sensing data streams mainly comprise two categories: spatial monitoring information streams and access behavior information streams. Spatial monitoring information streams include physical space activity information such as video surveillance data, access control records, and area intrusion detection information; access behavior information streams include logical resource operation information such as system login records, database operation logs, and file access records.

[0072] After acquiring multi-source sensing data streams, the first step is to unify the time base of these heterogeneous data streams. Since the clocks of different sensing devices may deviate, a Network Time Protocol (NTP) server is used as the unified time base to synchronize the local time of all devices to this base. For each data record, its original timestamp is read, the deviation from the base time is calculated, and a corrected unified timestamp is added. For example, if the original timestamp of a video surveillance data is "2023-05-20 14:30:25.350", and its clock deviation is calculated to be "+1.25 seconds", then the corrected unified timestamp will be "2023-05-20 14:30:26.600". Similarly, for system login records in the access behavior information stream, the original timestamp is "2023-05-20 14:30:27.120" with a clock deviation of "-0.58 seconds", and the corrected unified timestamp is "2023-05-20 14:30:26.540". In this way, all data records are mapped to a unified time base, forming a time-aligned multi-source sensing data stream.

[0073] Based on the time-aligned multi-source sensing data stream, key events are further extracted. For spatial monitoring information streams, physical location change events of personnel are identified through target detection and tracking algorithms. Specifically, background subtraction and target tracking algorithms are applied to video surveillance data. When a target is detected moving from area A to area B, it is recorded as a physical location change event, including information such as event ID, target ID, start position, end position, and occurrence time. For example, if a person with ID "P001" is detected moving from "Security Zone-1" to "Core Computer Room Area" at "2023-05-20 14:35:20.430", it is recorded as a physical location change event. For access behavior information streams, resource access operation events are extracted, including login attempts, file read / write, database queries, and other operations.

[0074] This function detects the timing deviation between physical location change events and resource access operation events. First, the extracted events are sorted by timestamp, and then the time intervals between related events are analyzed. A preset synchronization window of 8 seconds is used; if the time difference between a physical location change and a resource access operation exceeds 8 seconds, it is considered an asynchronous behavior segment. For example, if a user with ID "P001" enters the core data center area at "2023-05-20 14:35:20.430", and the associated user account "U001" accesses the financial database at "2023-05-20 14:35:22.105", the time difference is 1.675 seconds, which does not exceed the synchronization window and is therefore considered normal synchronization behavior. In another case, a person with the ID "P002" entered the general office area at "2023-05-20 15:10:05.230", while the associated user account "U002" accessed core server resources at "2023-05-20 15:10:25.790". The time difference was 20.56 seconds, exceeding the preset synchronous window, and was therefore judged as an asynchronous behavior segment. All events were arranged in chronological order to construct a complete sequence of behavioral characteristics.

[0075] For the identified asynchronous behavior segments, spatial security domain identifiers and logical permission domain identifiers are further extracted. Spatial security domain identifiers define the security level and access control requirements of the physical space; for example, the spatial security domain identifier for the "ordinary office area" is "S1," and the identifier for the "core computer room area" is "S3." Logical permission domain identifiers define the sensitivity level and access control requirements of information resources; for example, the logical permission domain identifier for "ordinary office documents" is "L1," and the identifier for the "financial database" is "L3." The coupling degree between the spatial security domain identifiers and logical permission domain identifiers is calculated. The coupling degree calculation is based on a predefined domain association matrix, which defines the compliant correspondence and weight values ​​of different security domains and permission domains. A preset coupling threshold of 0.6 is set; behaviors with a coupling degree lower than this threshold are judged as abnormal scene patterns. For example, the coupling degree calculated for accessing the financial database (L3) in the ordinary office area (S1) is 0.35, which is lower than the threshold of 0.6, therefore it is identified as an abnormal scene pattern and recorded in the scene feature sequence. Finally, a scene feature sequence containing complete scene anomaly patterns is constructed to provide a basis for subsequent security risk assessment.

[0076] By unifying the time base and timestamp annotation, the problem of inconsistent time series in multi-source data is resolved, improving the accuracy of data analysis. Based on time series deviation detection and asynchronous behavior recognition, abnormal behavior patterns of target objects at the physical space and resource access levels can be captured. Through coupling analysis of spatial security domains and logical permission domains, anomalies in scenarios such as cross-domain access can be effectively identified. This overcomes the limitations of traditional single-dimensional monitoring, achieving collaborative protection of physical and information security, and improving the security situational awareness capabilities of data centers. It also supports retrospective analysis of historical data, enabling timely detection of potential security risks and providing data support for security management decisions.

[0077] In one optional implementation, constructing an intention state transition model based on the evolution trajectory of behavioral feature sequences within a preset time window includes:

[0078] The behavioral feature sequence is segmented according to a preset time window to obtain multiple time window segments, each of which contains a behavioral feature subsequence within the corresponding time period.

[0079] Temporal encoding is performed on the behavioral feature subsequences within each time window segment to extract the evolution patterns of the behavioral feature subsequences. Based on the evolution patterns of each time window segment, the behavioral evolution trajectory is constructed.

[0080] The behavior evolution trajectory is divided into state spaces, and the evolution patterns in the behavior evolution trajectory are mapped to discrete intention state nodes. The transition relationship between intention state nodes between adjacent time window segments is identified, and the transition relationship includes the state transition direction and the state transition probability.

[0081] Based on the identified transition relationships, an intention state transition model is constructed. The intention state transition model includes multiple intention state nodes and state transition paths connecting the intention state nodes. The state transition paths record the intention evolution pattern of the behavioral feature sequence within a preset time window.

[0082] In this embodiment, the behavioral feature sequence is segmented according to a preset time window to obtain multiple time window segments. The preset time window can be set to 5 minutes, meaning that data from every 5 minutes constitutes a time window segment. For data center monitoring data, if CPU utilization data is collected once per second, a 5-minute time window segment will contain 300 data points. Each time window segment contains behavioral feature sub-sequences within the corresponding time period, and these sub-sequences record the changes in the data center's operational status during that time period.

[0083] Temporal encoding is performed on behavioral feature subsequences within each time window segment to extract their evolutionary patterns. The temporal encoding employs a sliding window method with a window size of 30 seconds and a step size of 5 seconds. Statistical features, including mean, variance, peak value, trough value, and rate of change, are calculated for the data within each sliding window. This method reduces the dimensionality of the original high-frequency data into feature vectors describing the evolutionary patterns. Taking CPU utilization as an example, temporal encoding can identify different evolutionary patterns such as stable state, upward trend, downward trend, and fluctuating state. Based on the evolutionary patterns of each time window segment, a behavioral evolution trajectory is constructed, reflecting the change in the data center's state over time.

[0084] The behavioral evolution trajectory is divided into state spaces, and a density clustering algorithm is used to cluster similar evolution patterns into the same intention state. The parameters for density clustering are set as follows: neighborhood radius 0.15, minimum number of points 8. Through cluster analysis, the evolution patterns in the behavioral evolution trajectory are mapped to discrete intention state nodes. In a data center monitoring scenario, these intention states may include normal operation, light load, heavy load, abnormal fluctuation, and performance degradation states. The transition relationship between intention state nodes between adjacent time window segments is identified, including the state transition direction and the state transition probability. The state transition direction represents the direction of change from one intention state to another, and the state transition probability is calculated by statistically analyzing the transition frequency between adjacent states in historical data.

[0085] Based on the identified transition relationships, an intent state transition model is constructed. This model employs a directed weighted graph structure, where nodes represent different intent states, edges represent transition paths between states, and the weights of the edges represent transition probabilities. During model construction, transition relationships occurring less than 1% of the total samples are considered noise and filtered out. The intent state transition model includes multiple intent state nodes and state transition paths connecting these nodes. These state transition paths record the evolution of the behavioral feature sequence within a preset time window.

[0086] In practical applications, when a data center is observed to transition from a normal operating state to a lightly loaded state, and this transition path typically evolves into a heavily loaded state in historical data, the system can provide early warning and take load balancing measures. The state transition model records the transition probability through edge weights. For example, the probability of transitioning from light load to heavy load is 0.75, the probability of returning from light load to normal state is 0.2, and the probability of jumping directly from light load to a performance degradation state is 0.05. These probability values ​​reflect the regularity of data center load changes and help predict future state changes.

[0087] The state transition model is updated using incremental learning, with an update performed every 24 hours of new data. The update process retains the original state nodes and adjusts only the transition probabilities, ensuring the model can adapt to dynamic changes in data center load characteristics. Newly emerging state transition relationships are added to the model if their frequency exceeds a threshold; conversely, state transition relationships that have not appeared for a long time are removed from the model if their probability is below a threshold, maintaining the model's simplicity and effectiveness.

[0088] In this embodiment, the evolution of server cluster behavior patterns can be accurately captured, enabling early warning and precise identification of abnormal states. Transforming time-series data into semantically meaningful intent state representations reduces the complexity of monitoring data and improves the accuracy of anomaly detection. The intent state transition model reflects the inherent patterns of data center state changes, supporting operations personnel in trend prediction and risk assessment, thereby achieving a shift from passive response to proactive prevention. It also possesses strong adaptability and scalability, allowing for flexible configuration based on data center scale and business characteristics, providing customized intelligent monitoring solutions for different types of data centers, effectively improving the stability and reliability of data center operations.

[0089] In one optional implementation, the intent state transition model identifies intermediate intent states during the attack preparation phase by mapping discrete behavioral features in a behavioral feature sequence to a continuous intent space, thus obtaining an intent evolution chain including:

[0090] Extract the intent state nodes from the intent state transition model, and semantically encode the evolution patterns of the intent state nodes to obtain semantic anchor vectors.

[0091] A continuous intent space is constructed based on semantic anchor vectors. A preparation intent region is divided in the continuous intent space by the state transition path in the intent state transition model. The preparation intent region corresponds to the transition path from the normal state node to the attack state node.

[0092] Semantic encoding is performed on discrete behavioral features in the behavioral feature sequence to obtain the current semantic vector. The vector distance between the current semantic vector and the semantic anchor vector is calculated, and the current semantic vector is mapped to the continuous intent space.

[0093] Identify the current semantic vector mapped to the preparation intent region, and determine whether the discrete behavioral features corresponding to the current semantic vector are located on the transition path from the normal state node to the attack state node based on the state transition path, and mark it as an intermediate intent state in the attack preparation stage.

[0094] By connecting the initial intention state node, intermediate intention state, and current intention state node along the state transition path, an intention evolution chain is constructed.

[0095] In the implementation process, it is necessary to extract the intent state nodes from the intent state transition model and semantically encode their evolution patterns to obtain semantic anchor vectors. For data center security monitoring scenarios, these intent state nodes include normal access states, resource exploration states, privilege escalation states, and data theft states. Semantic encoding employs context embedding technology to convert the feature description of each intent state node into a 256-dimensional vector representation. Specifically, for the normal access state, its feature description includes regular API call patterns, stable data access volume, and resource usage within the authorized scope; for the resource exploration state, its feature description includes frequent directory scanning, abnormal port probing, and repeated authentication attempts. These feature descriptions, after semantic encoding, form semantic anchor vectors representing different intent states.

[0096] A continuous intent space is constructed based on semantic anchor vectors. This space is a high-dimensional vector space, where each point represents a possible intent state. Preparation intent regions are then defined within this continuous intent space using state transition paths from the intent state transition model. These regions correspond to the transition paths from normal state nodes to attack state nodes. In data center security monitoring, preparation intent regions may include transition areas from normal access state to resource probing state, and from resource probing state to privilege escalation state, etc. The division of preparation intent regions employs a boundary expansion method, where the state transition path is used as the center line, and a specific distance is extended to both sides to form the region boundaries. The magnitude of the expansion distance is dynamically adjusted based on the deviation observed in historical attack data, typically set to 1.5 times the standard deviation in the semantic space.

[0097] Semantic encoding is performed on discrete behavioral features in the behavioral feature sequence to obtain the current semantic vector. Behavioral features include user operation logs, network traffic features, system call sequences, etc. Taking network traffic features as an example, semantic encoding is performed on features including source address, destination address, protocol type, packet size, and access frequency to obtain a semantic vector representing the current network behavior. The vector distance between the current semantic vector and the semantic anchor vector is calculated, using cosine similarity as the distance metric. The distance value ranges from 0 to 1, with smaller values ​​indicating greater similarity between the two vectors. The current semantic vector is then mapped to a continuous intent space to determine its position coordinates within the space.

[0098] The system identifies the current semantic vector mapped to the intent preparation region and determines whether the discrete behavioral feature corresponding to this semantic vector is located on the transition path from the normal state node to the attack state node based on the state transition path. The determination method is to calculate the vertical distance from the current semantic vector to the center line of the transition path; if the distance is less than a threshold (set to 0.2), the behavior is considered to be on the transition path. Simultaneously, the system calculates the projection position of this point along the path direction to determine which stage of the path it is in. Behavioral features that meet the criteria are marked as intermediate intent states in the attack preparation stage. Intermediate intent states may manifest as abnormal database query patterns, high-privilege operations outside of working hours, or continuous login attempts across multiple servers.

[0099] An intent evolution chain is constructed by connecting the initial intent state node, intermediate intent states, and the current intent state node along the state transition path. The intent evolution chain is an ordered sequence that records the evolution process from an initial normal state to the current possible attack state. For example, a typical intent evolution chain might include: normal access state → abnormal authentication attempt state (intermediate intent state) → resource directory scanning state (intermediate intent state) → sensitive database table access state (current intent state). Such an evolution chain reflects the attack path of an attacker from initial probing to gradual penetration.

[0100] In practical applications, when a user in a data center is detected transitioning from normal access mode to frequent directory scanning behavior, this behavior is encoded into a current semantic vector and mapped to a continuous intent space. By calculating the distance between this vector and each semantic anchor vector, it is found that it is closest to the resource probing state, but does not yet fully conform to the characteristics of that state. Further analysis reveals that this vector lies on the transition path from the normal access state to the resource probing state, thus marking it as an intermediate intent state in the attack preparation phase. Subsequently, an intent evolution chain is constructed: normal access state → directory scanning behavior (intermediate intent state), and based on historical attack patterns, the next step is predicted to potentially evolve into a complete resource probing state, thereby issuing an early security warning.

[0101] In this embodiment, the construction of a continuous intent space enables the system to capture subtle correlations between behavioral features, bridging the semantic gap between discrete behavioral features and security intents. The generation of the intent evolution chain provides clear contextual information for security analysis, not only displaying the current security status but also revealing the formation process and potential development trends of threats. It boasts advantages such as strong adaptability and a low false alarm rate, enabling it to cope with constantly evolving attack methods and providing data centers with more proactive and accurate security protection capabilities, significantly improving the security situation awareness and early warning response capabilities of data centers.

[0102] In one optional implementation, the intent evolution chain is temporally aligned with the scene feature sequence, semantic deviation is calculated, and for target objects whose semantic deviation exceeds a preset deviation range, the behavioral nodes that trigger intermediate intent state transitions are traced back in the intent evolution chain to construct a causal reasoning chain, including:

[0103] Align the intermediate intent states in the intent evolution chain with the scene feature segments in the scene feature sequence by timestamp, extract the evolution direction vector of the intermediate intent state and the evolution direction vector of the scene feature segment, and calculate the angle between the vectors to obtain the semantic deviation.

[0104] Construct a temporal variation curve of semantic deviation, identify the turning point on the temporal variation curve where the semantic deviation changes from not exceeding the preset deviation range to exceeding the preset deviation range, and extract the time corresponding to the turning point as the deviation trigger time.

[0105] Locate the intermediate intention state node that deviates from the trigger time in the intention evolution chain, trace back along the state transition path to the intermediate intention state node before the deviating from the trigger time, extract the behavior node between the two intermediate intention state nodes as the trigger behavior node, and calculate the state transition probability increment caused by the trigger behavior node.

[0106] Based on the state transition probability increment, the triggering behavior node and the predecessor behavior node are causally weighted to construct a causal reasoning chain.

[0107] This implementation first aligns the intermediate intent states in the intent evolution chain with the scene feature segments in the scene feature sequence by timestamp. The intent evolution chain records the behavioral intent changes of a target object (such as a specific user account, application, or server), while the scene feature sequence describes the state changes of the overall data center environment. Time alignment uses a sliding window method with a window size of 10 minutes and a step size of 1 minute to ensure that each intermediate intent state can accurately match the scene feature segment of its corresponding time period. The evolution direction vector of the intermediate intent state is extracted, representing the trend of the intent state's change in the continuous intent space. Similarly, the evolution direction vector of the scene feature segment is extracted, representing the trend of the overall scene state. The angle between the two direction vectors is calculated to obtain the semantic deviation. The semantic deviation is calculated using vector cosine similarity, converting the cosine similarity into an angle value ranging from 0 to 180 degrees; a larger value indicates a higher degree of deviation.

[0108] Construct a time-series curve of semantic deviation, reflecting the consistency changes between the target object's behavioral intent and the overall environmental state. Under normal circumstances, user behavior and environmental state should maintain a certain degree of coordination, such as during system upgrades with batch restarts or during peak business periods with intensive resource usage. Identify the turning point on the time-series curve where the semantic deviation changes from within a preset deviation range to exceeding it. The preset deviation range is derived from historical data statistics and is typically set as the average semantic deviation under normal conditions plus or minus two standard deviations; for data center monitoring, this range may be 30 to 60 degrees. Extract the moment corresponding to the turning point as the deviation trigger moment, marking the beginning of an abnormal deviation between the target object's behavior and the environmental state.

[0109] In the intent evolution chain, the intermediate intent state node corresponding to the deviation from the trigger time is located. This node reflects the target object's behavioral intent state at the time of deviation. The state transition path is traced backward to the intermediate intent state node before the deviation from the trigger time; this preceding node represents the target object's state before the abnormal deviation. Behavioral nodes between two intermediate intent state nodes are extracted as triggering behavioral nodes. These nodes record the specific behavior that led to the state transition. Triggering behavioral nodes may include abnormal privilege escalation operations, unauthorized configuration modifications, or sensitive data access during abnormal periods. The state transition probability increment caused by the triggering behavioral node is calculated, i.e., the increase in the state transition probability relative to the baseline probability after the occurrence of this behavioral node. The state transition probability increment is calculated using the conditional probability difference method, subtracting the baseline probability when the triggering behavioral node exists from the state transition probability when the triggering behavioral node does not exist.

[0110] A causal inference chain is constructed by causally weighting the triggering behavior node and its predecessor behavior node based on the state transition probability increment. The causal weighting is normalized so that the sum of all weights is 1. The weight values ​​reflect the contribution of each behavior node to the final state transition. The causal inference chain is a directed graph structure, where nodes represent behaviors, edges represent causal relationships, and edge weights represent causal strength. During construction, behavior nodes with a state transition probability increment less than 0.05 are considered noise data and filtered out.

[0111] In practical application, a user account's semantic deviation suddenly increased from 45 degrees to 75 degrees, exceeding the preset deviation range (60 degrees). The trigger time was located at 3:15 AM, corresponding to the intermediate intent state of "large-scale data transmission state". Reverse tracing revealed that the preceding intermediate intent state was "database query optimization state," with the behavioral nodes between them including "modifying database connection configuration," "batch querying sensitive tables," and "establishing external network connections." The state transition probability increments for these behavioral nodes were calculated to be 0.15, 0.35, and 0.25, respectively. Based on this, a causal inference chain was constructed: Database query optimization → Modifying database connection configuration (weight 0.2) → Batch querying sensitive tables (weight 0.47) → Establishing external network connections (weight 0.33) → Large-scale data transmission. Through this causal inference chain, it was determined that this was a data theft incident, and the batch querying of sensitive tables was precisely the main triggering factor.

[0112] To verify the accuracy of the causal inference, the system conducted a backtracking analysis of historical data. It was found that under normal business scenarios, the state after database query optimization typically transitions to the "query performance improvement state" with a transition probability of 0.85, while the probability of transitioning to the "large-scale data transmission state" is only 0.03. When a "batch query of sensitive tables" behavior node occurs, the probability of transitioning to the "large-scale data transmission state" increases to 0.38, with an increment of 0.35 in the state transition probability, confirming a strong causal relationship between this behavior node and the abnormal state transition.

[0113] By implementing this method, key behaviors leading to abnormal states can be accurately identified from massive amounts of monitoring data, constructing a clear causal reasoning chain and providing strong decision support for security analysis and incident response. The introduction of semantic deviation enables the system to distinguish between normal state changes and potential security threats in complex environments, effectively reducing false alarm rates. Temporal alignment and reverse tracing techniques achieve precise location from result to cause, overcoming the limitations of traditional correlation analysis. The causal weighting mechanism considers the combined effects of multiple behavioral nodes, enabling the discovery of complex attack paths and hidden anomaly patterns.

[0114] like Figure 2 The diagram illustrates the attack tracing process in this embodiment.

[0115] In one optional implementation, the contribution of each behavioral node in the causal inference chain to the final abnormal state is calculated, the attack initiation point and propagation path are identified, and the source tracing results are obtained, including:

[0116] Extract the state transition probability increments caused by each behavioral node in the causal inference chain, and accumulate the state transition probability increments along the causal association direction of the causal inference chain to obtain the cumulative contribution of each behavioral node to the final abnormal state.

[0117] The cumulative contribution of each behavioral node in the causal reasoning chain is calculated by reverse difference. The behavioral nodes whose cumulative contribution changes from zero to non-zero by reverse difference are marked as the attack starting point.

[0118] Extract the sequence of behavioral nodes with monotonically increasing cumulative contribution from the attack starting point along the causal relationship direction. Calculate the increment ratio between adjacent nodes for the cumulative contribution of each behavioral node in the sequence. Identify the behavioral nodes with accelerating cumulative contribution as propagation acceleration nodes based on the increment ratio. Combine the attack starting point, propagation acceleration nodes, and their connected behavioral node sequences to form a propagation path.

[0119] The attack origin and propagation path are combined to form the source tracing result.

[0120] In this implementation, the state transition probability increment triggered by each behavioral node in the causal inference chain is first extracted. For data center monitoring scenarios, the state transition probability increment represents the increase in the probability of the system state transitioning to an abnormal state relative to the baseline probability after the occurrence of a certain behavioral node. The state transition probability increment is obtained through statistical analysis of historical monitoring data, and the calculation method is the conditional probability of state transition after the occurrence of a behavioral node minus the baseline transition probability. The state transition probability increment is accumulated along the causal association direction of the causal inference chain to obtain the cumulative contribution of each behavioral node to the final abnormal state. The cumulative contribution calculation adopts a progressive accumulation method. Starting from the starting node of the causal inference chain, the state transition probability increment of the current node is added to the cumulative contribution of the predecessor node in turn, and a contribution reduction factor is applied for adjustment. The reduction factor is set to 0.85, reflecting the attenuation characteristic of causal effect with propagation distance.

[0121] The cumulative contribution of each behavioral node in the causal inference chain is calculated using reverse differential calculation. The reverse differential value represents the difference between the cumulative contribution of the current node and the cumulative contribution of its predecessor node. The reverse differential calculation starts from the end node of the causal inference chain and proceeds in the opposite direction to the causal association, calculating the difference in cumulative contribution between adjacent nodes sequentially. Behavioral nodes whose reverse differential value changes from zero to non-zero are identified as attack initiation points. Attack initiation points typically manifest as the first abnormal login, unauthorized configuration modification, or suspicious command execution. The accuracy of attack initiation point identification directly affects the reliability of the tracing results. To improve accuracy, a reverse differential threshold of 0.05 is set; only behavioral nodes with reverse differential values ​​greater than this threshold are considered potential attack initiation points.

[0122] The attack originates from a sequence of behavioral nodes whose cumulative contribution increases monotonically along the causal path. This monotonically increasing sequence represents the continuous progression of the attack, reflecting the attack chain from initial intrusion to the final target. The incremental ratio between adjacent nodes is calculated for the cumulative contribution of each behavioral node in the sequence. This ratio is calculated as the ratio of the current node's cumulative contribution to that of its predecessor node. Behavioral nodes with accelerating cumulative contribution are identified as propagation acceleration nodes based on this incremental ratio. The threshold for this ratio is set to 1.5, meaning that a node is marked as a propagation acceleration node when its cumulative contribution is at least 1.5 times that of its predecessor node. Propagation acceleration nodes typically correspond to key attack steps, such as privilege escalation, data theft, and backdoor implantation. The attack origin, propagation acceleration nodes, and their connected behavioral node sequences are combined to form a propagation path. This propagation path is a directed path that reflects the complete process of the attack from initiation to spread.

[0123] Combining the attack's origin and propagation path forms the attribution result, which includes the attack's initiation location, propagation route, and key nodes, providing detailed event context information for security response. The attribution result is represented in the form of a directed graph, where nodes represent behaviors, edges represent causal relationships, node size represents the cumulative contribution, and edge thickness represents the strength of the causal relationship.

[0124] In a practical application, a data center monitoring system detects a data breach. The constructed causal chain includes the following behavioral nodes: remote login to server A → execution of permission query commands → modification of firewall rules → installation of proxy tools → establishment of a covert channel → batch data transfer → log clearing. The calculated state transition probability increments for each behavioral node are 0.15, 0.08, 0.25, 0.20, 0.35, 0.40, and 0.10, respectively. The cumulative contribution calculated using the progressive accumulation method is 0.15, 0.20, 0.41, 0.55, 0.82, 1.16, and 1.24. Reverse difference calculations are performed on the cumulative contribution, yielding reverse difference values ​​of 0.15, 0.05, 0.21, 0.14, 0.27, 0.34, and 0.08. The behavioral node whose reverse difference value changes from zero to non-zero is identified as "remote login to server A," and it is marked as the attack initiation point.

[0125] The attack origin was analyzed by extracting a sequence of behavioral nodes with monotonically increasing cumulative contribution along the causal relationship. The incremental ratios between adjacent nodes were calculated to be 1.33, 2.05, 1.34, 1.49, 1.41, and 1.07. Based on an incremental ratio threshold of 1.5, "Modifying firewall rules" was identified as a propagation acceleration node, with an incremental ratio of 2.05, significantly higher than the threshold. The attack origin "Remote login to server A," the propagation acceleration node "Modifying firewall rules," and their connected sequence of behavioral nodes formed a propagation path: Remote login to server A → Executing permission query commands → Modifying firewall rules → Installing proxy tools → Establishing a covert channel → Batch data transmission → Clearing logs. This propagation path clearly demonstrates the complete attack chain from initial intrusion to data theft, with "Modifying firewall rules" being a crucial step in the attack's spread, creating conditions for subsequent malicious actions by the attacker.

[0126] In this embodiment, the attack initiation point and key propagation nodes can be accurately extracted from complex causal networks, constructing a complete attack attribution map and providing precise location for security response and intrusion prevention. The cumulative contribution analysis mechanism overcomes the limitations of traditional rule-based or feature-matching-based attribution methods, capturing the implicit correlations and evolutionary patterns between attack behaviors. Reverse differential technology enables accurate identification of attack sources, while incremental ratio analysis reveals key turning points in the attack process, allowing defense resources to be concentrated on the most influential links. This method not only handles known attack patterns but also adapts to new attack techniques, automatically identifying abnormal links in the attack chain through contribution calculation, providing interpretable attribution results for security analysis, significantly improving the efficiency and accuracy of data center security incident investigations, thereby strengthening the overall security protection capabilities of the data center.

[0127] In one optional implementation, based on the attack origination point location and the number of behavioral nodes in the causal inference chain in the tracing results, the isolation range and blocking timing are determined, and early warning control instructions are generated, including:

[0128] Extract the position index of the attack starting point in the causal reasoning chain, and count the number of behavioral nodes from the attack starting point to the final abnormal state.

[0129] Construct a causal influence domain centered on the attack initiation point, calculate the causal correlation strength attenuation coefficient between each behavioral node in the causal inference chain and the attack initiation point, include behavioral nodes whose causal correlation strength attenuation coefficient is greater than the attenuation threshold into the causal influence domain, and determine the causal influence domain as the isolation range.

[0130] Extract the state transition time interval of each behavior node within the isolation range, construct the state transition time series, perform time series prediction on the state transition time series to obtain the boundary arrival time of the attack reaching the boundary of the isolation range, and subtract the preset lead time from the boundary arrival time to determine the blocking timing.

[0131] The isolation range and blocking timing are encapsulated to generate early warning and control commands.

[0132] In this implementation, the first step is to extract the position index of the attack initiation point within the causal inference chain. The position index represents the relative position of the attack initiation point within the entire causal inference chain and is used to assess the attack's progress. The position index is calculated based on the topological sorting of nodes, starting from the initial node of the causal inference chain; the number of nodes preceding the attack initiation point is its position index value. The number of behavioral nodes between the attack initiation point and the final anomalous state is then counted. This number reflects the complexity of the attack path and the progress of the attack phase. A higher number of behavioral nodes indicates a more complex attack process, requiring more comprehensive defensive measures.

[0133] A causal influence domain centered on the attack initiation point is constructed. This domain includes all behavioral nodes affected by the attack initiation point and their associated system resources. The attenuation coefficient of the causal association strength between each behavioral node in the causal inference chain and the attack initiation point is calculated. The attenuation coefficient is calculated using a distance attenuation function, which exhibits exponential decay with a base of 0.8 and an exponent representing the distance between nodes. Specifically, for a behavioral node n steps away from the attack initiation point, its attenuation coefficient is 0.8 to the power of n. This attenuation coefficient reflects the weakening law of causal influence with propagation distance. Behavioral nodes with a causal association strength attenuation coefficient greater than an attenuation threshold are included in the causal influence domain. The attenuation threshold is set to 0.3, meaning nodes with an attenuation coefficient greater than 0.3 are considered significantly affected and included in the causal influence domain. The causal influence domain is defined as an isolation range, and resources within this range will be subject to security control measures to prevent further spread of the attack.

[0134] The state transition time intervals of each behavioral node within the isolation range are extracted. These intervals, representing the time difference between adjacent nodes, reflect the temporal rhythm of the attack. A state transition time series is constructed, recording the time required for an attack to propagate from one node to the next. Time series forecasting is performed on this series using exponential smoothing with a smoothing factor of 0.7, suitable for time series exhibiting a certain trend but also fluctuations. Through time series forecasting, the boundary arrival time of the attack at the isolation range boundary is estimated, i.e., the expected time for the attack to spread to the outermost node within the isolation range. The boundary arrival time minus a preset lead time is used to determine the blocking timing. This preset lead time is set based on the data center's security response capabilities, typically 5 to 10 minutes, ensuring that defense deployment is completed before the attack spreads.

[0135] The isolation scope and blocking timing are encapsulated into early warning control commands. These commands include information such as a list of isolated objects, isolation operation type, execution time, and priority. The commands use a standardized JSON format for easy integration with data center security control systems. Command priorities are dynamically adjusted based on the severity and urgency of the attack. Severity assessment is based on the hazard level of the final abnormal state, while urgency assessment is based on the difference between the blocking timing and the current time.

[0136] For example, a data center monitoring system detects a suspicious data access behavior. The constructed causal reasoning chain contains 7 behavioral nodes: external SSH connection → abnormal user login → directory traversal → database configuration file reading → database connection establishment → sensitive table query → data transmission. Through source tracing analysis, "abnormal user login" is determined to be the attack starting point, with its position index 1 (counting from 0). There are 5 behavioral nodes between the attack starting point and the final abnormal state "data transmission".

[0137] The attenuation coefficient of the causal association between each behavioral node and the attack origin was calculated. The attenuation coefficient for "abnormal user login" was 1, for "directory traversal" it was 0.8, for "database configuration file reading" it was 0.64, for "database connection establishment" it was 0.51, for "sensitive table query" it was 0.41, for "data transfer" it was 0.33, and for "external SSH connection" it was 0.8 (calculated in reverse). All behavioral nodes with an attenuation coefficient greater than the attenuation threshold of 0.3 were included in the causal influence domain, meaning all 7 nodes were included in the isolation range.

[0138] The state transition time intervals of each behavioral node within the isolation range are extracted, resulting in a time interval sequence of 35 seconds, 28 seconds, 42 seconds, 23 seconds, 47 seconds, and 60 seconds. Exponential smoothing is applied to this time series for prediction, forecasting the next possible state transition time interval as 53 seconds. Based on the timestamp of the last observed node's "data outflow" at 10:15:37, the attack is predicted to spread to nodes outside the isolation range around 10:16:30. Subtracting a preset lead time of 8 minutes from the boundary arrival time, the blocking timing is determined to be 10:08:30.

[0139] A warning control command is generated, including: a list of server IP addresses covered by the isolation zone, database instance identifiers, network connections to be blocked, and user permissions to be revoked; control operation types include network isolation, account locking, and process termination; the execution time is set to 10:08:30; and the priority is set to "high". This warning control command will be sent to the data center's security control system, triggering an automated security response process.

[0140] In this embodiment, the optimal defense strategy can be automatically determined based on attack attribution results, achieving closed-loop control from threat detection to security response. Causal impact domain analysis technology enables the system to accurately define the attack's scope, avoiding business interruptions caused by excessive isolation while ensuring effective control of security risks. The time-series prediction mechanism considers the temporal characteristics of attack behavior, accurately grasping the timing of defense and completing defense deployment before the attack causes substantial harm. The automatic generation of early warning control commands significantly improves the speed and accuracy of security response, reducing the need for manual intervention, making it particularly suitable for the security management of large-scale data centers. This method not only enhances the defense capability against known attack patterns but also addresses variant attacks through causal analysis and time-series prediction, exhibiting strong adaptability and foresight, providing a more intelligent and automated technical means for data center security protection.

[0141] A second aspect of the present invention provides a data center intelligent monitoring system, the system comprising:

[0142] The first unit is used to acquire multi-source sensing data streams within the controlled area of ​​the data center and decouple them in the spatiotemporal dimension, and extract the behavioral feature sequence and scene feature sequence of the target object;

[0143] The second unit is used to construct an intent state transition model based on the evolution trajectory of the behavioral feature sequence within a preset time window. The intent state transition model maps discrete behavioral features in the behavioral feature sequence to a continuous intent space, identifies intermediate intent states in the attack preparation phase, and obtains the intent evolution chain.

[0144] The third unit is used to align the intent evolution chain with the scene feature sequence in time, calculate the semantic deviation, and for target objects whose semantic deviation exceeds the preset deviation range, trace back the behavior node that triggers the intermediate intent state transition in the intent evolution chain to construct a causal reasoning chain.

[0145] The fourth unit is used to calculate the contribution of each behavioral node in the causal inference chain to the final abnormal state, identify the attack starting point and propagation path, and obtain the source tracing results.

[0146] The fifth unit is used to determine the isolation range and blocking timing based on the location of the attack starting point and the number of behavioral nodes in the causal reasoning chain in the tracing results, and to generate early warning and control instructions.

[0147] A third aspect of the present invention provides an electronic device, comprising:

[0148] processor;

[0149] Memory used to store processor-executable instructions;

[0150] The processor is configured to invoke instructions stored in the memory to execute the aforementioned method.

[0151] A fourth aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0152] This invention can be a method, apparatus, system, and / or computer program product. The computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for performing various aspects of the invention.

[0153] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A data center intelligent monitoring method, characterized in that, include: Acquire multi-source sensing data streams within the controlled area of ​​the data center and decouple them in terms of spatiotemporal dimensions to extract the behavioral feature sequences and scene feature sequences of the target objects; Based on the evolution trajectory of the behavioral feature sequence within a preset time window, an intent state transition model is constructed. The intent state transition model maps discrete behavioral features in the behavioral feature sequence to a continuous intent space, identifies intermediate intent states in the attack preparation phase, and obtains the intent evolution chain. The intent evolution chain is temporally aligned with the scene feature sequence, the semantic deviation is calculated, and for target objects whose semantic deviation exceeds the preset deviation range, the behavior nodes that trigger intermediate intent state transitions are traced back in the intent evolution chain to construct a causal reasoning chain. Calculate the contribution of each behavioral node in the causal inference chain to the final abnormal state, identify the attack starting point and propagation path, and obtain the source tracing results; Based on the location of the attack origin and the number of behavioral nodes in the causal reasoning chain in the tracing results, the isolation range and blocking timing are determined, and early warning control instructions are generated.

2. The method according to claim 1, characterized in that, Acquire multi-source sensing data streams within a controlled area of ​​the data center and decouple them in terms of spatiotemporal dimensions. Extract behavioral feature sequences and scene feature sequences of the target objects, including: Multi-source sensing data streams are obtained from distributed sensing nodes within the controlled area of ​​the data center. These multi-source sensing data streams include spatial monitoring information streams and access behavior information streams. The time reference of data records in the spatial monitoring information flow and access behavior information flow is unified, and a unified timestamp is marked for each data record to obtain a time-aligned multi-source sensing data flow; Based on the time-aligned multi-source sensing data stream, physical location change events in the spatial monitoring information stream and resource access operation events in the access behavior information stream are extracted. The timing deviation between physical location change events and resource access operation events is detected, asynchronous behavior segments whose timing deviation exceeds a preset synchronization window are identified, and the timing is arranged to construct a sequence of behavior features. For asynchronous behavior segments in the behavior feature sequence, extract the spatial security domain identifier and the logical permission domain identifier, calculate the coupling degree between the spatial security domain identifier and the logical permission domain identifier, identify scene abnormal patterns with coupling degree lower than a preset coupling threshold, and construct a scene feature sequence containing scene abnormal patterns.

3. The method according to claim 1, characterized in that, Based on the evolution trajectory of behavioral feature sequences within a preset time window, the intention state transition model is constructed as follows: The behavioral feature sequence is segmented according to a preset time window to obtain multiple time window segments, each of which contains a behavioral feature subsequence within the corresponding time period. Temporal encoding is performed on the behavioral feature subsequences within each time window segment to extract the evolution patterns of the behavioral feature subsequences. Based on the evolution patterns of each time window segment, the behavioral evolution trajectory is constructed. The behavior evolution trajectory is divided into state spaces, and the evolution patterns in the behavior evolution trajectory are mapped to discrete intention state nodes. The transition relationship between intention state nodes between adjacent time window segments is identified, and the transition relationship includes the state transition direction and the state transition probability. Based on the identified transition relationships, an intention state transition model is constructed. The intention state transition model includes multiple intention state nodes and state transition paths connecting the intention state nodes. The state transition paths record the intention evolution pattern of the behavioral feature sequence within a preset time window.

4. The method according to claim 1, characterized in that, The intent state transition model maps discrete behavioral features in a behavioral feature sequence to a continuous intent space, identifies intermediate intent states during the attack preparation phase, and obtains an intent evolution chain including: Extract the intent state nodes from the intent state transition model, and semantically encode the evolution patterns of the intent state nodes to obtain semantic anchor vectors. A continuous intent space is constructed based on semantic anchor vectors. A preparation intent region is divided in the continuous intent space by the state transition path in the intent state transition model. The preparation intent region corresponds to the transition path from the normal state node to the attack state node. Semantic encoding is performed on discrete behavioral features in the behavioral feature sequence to obtain the current semantic vector. The vector distance between the current semantic vector and the semantic anchor vector is calculated, and the current semantic vector is mapped to the continuous intent space. Identify the current semantic vector mapped to the preparation intent region, and determine whether the discrete behavioral features corresponding to the current semantic vector are located on the transition path from the normal state node to the attack state node based on the state transition path, and mark it as an intermediate intent state in the attack preparation stage. By connecting the initial intention state node, intermediate intention state, and current intention state node along the state transition path, an intention evolution chain is constructed.

5. The method according to claim 1, characterized in that, The intent evolution chain is temporally aligned with the scene feature sequence, and the semantic deviation is calculated. For target objects whose semantic deviation exceeds a preset deviation range, the behavior nodes that trigger intermediate intent state transitions are traced back in the intent evolution chain to construct a causal reasoning chain, including: Align the intermediate intent states in the intent evolution chain with the scene feature segments in the scene feature sequence by timestamp, extract the evolution direction vector of the intermediate intent state and the evolution direction vector of the scene feature segment, and calculate the angle between the vectors to obtain the semantic deviation. Construct a temporal variation curve of semantic deviation, identify the turning point on the temporal variation curve where the semantic deviation changes from not exceeding the preset deviation range to exceeding the preset deviation range, and extract the time corresponding to the turning point as the deviation trigger time. Locate the intermediate intention state node that deviates from the trigger time in the intention evolution chain, trace back along the state transition path to the intermediate intention state node before the deviating from the trigger time, extract the behavior node between the two intermediate intention state nodes as the trigger behavior node, and calculate the state transition probability increment caused by the trigger behavior node. Based on the state transition probability increment, the triggering behavior node and the predecessor behavior node are causally weighted to construct a causal reasoning chain.

6. The method according to claim 1, characterized in that, Calculate the contribution of each behavioral node in the causal inference chain to the final abnormal state, identify the attack initiation point and propagation path, and obtain the following tracing results: Extract the state transition probability increments caused by each behavioral node in the causal inference chain, and accumulate the state transition probability increments along the causal association direction of the causal inference chain to obtain the cumulative contribution of each behavioral node to the final abnormal state. The cumulative contribution of each behavioral node in the causal reasoning chain is calculated by reverse difference. The behavioral nodes whose cumulative contribution changes from zero to non-zero by reverse difference are marked as the attack starting point. Extract the sequence of behavioral nodes with monotonically increasing cumulative contribution from the attack starting point along the causal relationship direction. Calculate the increment ratio between adjacent nodes for the cumulative contribution of each behavioral node in the sequence. Identify the behavioral nodes with accelerating cumulative contribution as propagation acceleration nodes based on the increment ratio. Combine the attack starting point, propagation acceleration nodes, and their connected behavioral node sequences to form a propagation path. The attack origin and propagation path are combined to form the source tracing result.

7. The method according to claim 1, characterized in that, Based on the attack origination point location and the number of behavioral nodes in the causal inference chain in the tracing results, the isolation range and blocking timing are determined, and early warning control instructions are generated, including: Extract the position index of the attack starting point in the causal reasoning chain, and count the number of behavioral nodes from the attack starting point to the final abnormal state. Construct a causal influence domain centered on the attack initiation point, calculate the causal correlation strength attenuation coefficient between each behavioral node in the causal inference chain and the attack initiation point, include behavioral nodes whose causal correlation strength attenuation coefficient is greater than the attenuation threshold into the causal influence domain, and determine the causal influence domain as the isolation range. Extract the state transition time interval of each behavior node within the isolation range, construct the state transition time series, perform time series prediction on the state transition time series to obtain the boundary arrival time of the attack reaching the boundary of the isolation range, and subtract the preset lead time from the boundary arrival time to determine the blocking timing. The isolation range and blocking timing are encapsulated to generate early warning and control commands.

8. A data center intelligent monitoring system, used to implement the method of any one of claims 1-7, characterized in that, include: The first unit is used to acquire multi-source sensing data streams within the controlled area of ​​the data center and decouple them in the spatiotemporal dimension, and extract the behavioral feature sequence and scene feature sequence of the target object; The second unit is used to construct an intent state transition model based on the evolution trajectory of the behavioral feature sequence within a preset time window. The intent state transition model maps discrete behavioral features in the behavioral feature sequence to a continuous intent space, identifies intermediate intent states in the attack preparation phase, and obtains the intent evolution chain. The third unit is used to align the intent evolution chain with the scene feature sequence in time, calculate the semantic deviation, and for target objects whose semantic deviation exceeds the preset deviation range, trace back the behavior node that triggers the intermediate intent state transition in the intent evolution chain to construct a causal reasoning chain. The fourth unit is used to calculate the contribution of each behavioral node in the causal inference chain to the final abnormal state, identify the attack starting point and propagation path, and obtain the source tracing results. The fifth unit is used to determine the isolation range and blocking timing based on the location of the attack starting point and the number of behavioral nodes in the causal reasoning chain in the tracing results, and to generate early warning and control instructions.

9. An electronic device, characterized in that, include: processor; Memory used to store processor-executable instructions; The processor is configured to invoke instructions stored in the memory to execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having computer program instructions stored thereon, characterized in that, When the computer program instructions are executed by the processor, they implement the method described in any one of claims 1 to 7.

Images