A server process defense method

Abstract

The application provides a kind of server process defense method and system, it is related to network security field, the method comprises: obtaining the multidimensional running parameter data of server process;According to historical multidimensional running parameter data, construct the training data set containing known normal state sample and abnormal state sample;According to training data set, the multidimensional running parameter data obtained is carried out preliminary anomaly detection by K-neighbor algorithm, and preliminary abnormal sample data is obtained;The similarity between preliminary abnormal sample data and known normal state sample is calculated, and the similarity value is obtained;Set similarity threshold, and compare similarity value with similarity threshold, identify abnormal sample data.The application realizes the efficient protection of server process by four core modules of data acquisition, anomaly detection, strategy optimization and dynamic adjustment.

Description

Technical Field

[0001] This invention relates to the field of network security, and in particular to a method for defending server processes. Background Technology

[0002] With the popularization of cloud computing, the Internet of Things and distributed systems, server processes are facing increasingly complex attack methods, including injection attacks, denial of service, malware implantation, privilege escalation and so on. Traditional defense methods (such as firewalls and intrusion detection systems IDS) rely on static rule bases, which are difficult to deal with new attack patterns, and have high false positive rates and poor adaptability.

[0003] Threshold-based detection methods are insensitive to dynamic attacks and prone to false negatives. Supervised learning models rely on labeled data, but anomalous samples are scarce and labeling is costly. Unsupervised learning has limited performance on high-dimensional data and lacks dynamic optimization capabilities. Existing defense mechanisms cannot adjust to real-time attack characteristics and are easily bypassed by attackers. Strict policies lead to normal service interruptions, while lenient policies cannot effectively block attacks. Defense strategies need to be dynamically adjusted to cope with new types of attacks; static configurations are difficult to adapt to real-time threats. Summary of the Invention

[0004] The technical problem to be solved by this invention is to provide a server process defense method, which achieves efficient protection of server processes through four core modules: data collection, anomaly detection, strategy optimization and dynamic adjustment.

[0005] To solve the above-mentioned technical problems, the technical solution of the present invention is as follows: Obtain multi-dimensional runtime parameter data of the server process; Based on historical multi-dimensional operating parameter data, a training dataset containing known normal state samples and abnormal state samples is constructed. Based on the training dataset, the K-nearest neighbor algorithm is used to perform preliminary anomaly detection on the acquired multi-dimensional running parameter data to obtain preliminary anomaly sample data; The similarity value is obtained by calculating the similarity between the preliminary abnormal sample data and the known normal state samples; Set a similarity threshold and compare the similarity value with the similarity threshold to identify abnormal sample data; Based on abnormal sample data, the configuration parameters of the defense mechanism are optimized using a genetic algorithm to obtain a defense strategy; Dynamically adjust and execute defense strategies to achieve server process protection.

[0006] Firstly, a server process defense method, the method comprising: Furthermore, obtain multi-dimensional runtime parameter data of the server process, including: By monitoring server processes, and based on process characteristics, we define and collect multi-dimensional operational parameter metrics, including CPU utilization, memory usage, etc. Configure the data collection frequency based on multi-dimensional operating parameter indicators; Based on the data collection frequency, multi-dimensional operating parameter data is obtained by deploying a data collection agent; The collected multi-dimensional operating parameters are stored in the database to obtain multi-dimensional operating parameter data.

[0007] Furthermore, based on historical multi-dimensional operational parameter data, a training dataset containing known normal state samples and abnormal state samples is constructed, including: By identifying historical multi-dimensional operational parameter data and labeling data status, normal and abnormal states can be distinguished. Based on the data status labels, samples in normal state and samples in abnormal state are initially screened. By filtering normal and abnormal state samples, adjusting the ratio of normal and abnormal state sample sets, and merging the normal and abnormal sample sets, a complete training dataset is obtained.

[0008] Furthermore, based on the training dataset, the K-nearest neighbor algorithm is used to perform preliminary anomaly detection on the acquired multi-dimensional runtime parameter data, resulting in preliminary anomaly sample data, including: Based on the training dataset, select a K value, calculate the difference between the test sample and the training sample in each feature dimension, divide the difference in each feature dimension by a quantity related to the sum of the differences in all feature dimensions, apply the Minkowski distance formula to the adjusted difference, sum the distances in all dimensions, and take the result. The power of this power yields the distance between the sample to be tested and the training samples; Based on the calculated distance, select the K nearest training samples and calculate the state labels of the K nearest neighbor samples; By statistically analyzing status labels and setting anomaly detection threshold, multi-dimensional operational parameter data are compared with the threshold to preliminarily determine sample anomalies and form a preliminary abnormal sample dataset.

[0009] Furthermore, by calculating the similarity between the preliminary abnormal sample data and the known normal state samples, a similarity value is obtained, including: Based on the preliminary abnormal sample data and the known normal sample data, the similarity between a single preliminary abnormal sample and all normal samples is calculated. The similarity is Pearson correlation, with a value range of [−1,1]. A value closer to 1 indicates a stronger linear correlation. By summing the similarity scores between a single preliminary abnormal sample and all normal samples, a set of similarity scores is formed. By using a set of similarity values, a summary similarity statistic is selected to represent the initial similarity between abnormal samples and normal samples; Based on the similarity summary statistics, the similarity summary statistics of all preliminary abnormal samples are calculated using the above formula to obtain the preliminary abnormal sample data.

[0010] Furthermore, a similarity threshold is set, and the similarity values ​​are compared with the similarity threshold to identify abnormal sample data, including: By using preliminary abnormal sample data, a similarity threshold is set to distinguish between normal and abnormal samples; Based on the set similarity threshold, the summation statistics of the similarity of each preliminary abnormal sample are compared with the threshold, and marked as normal or abnormal. The initial abnormal samples that are marked as abnormal are integrated into an abnormal sample list to obtain abnormal sample data.

[0011] Furthermore, based on the abnormal sample data, the configuration parameters of the defense mechanism are optimized using a genetic algorithm to obtain a defense strategy, including: Based on the abnormal sample data, the configuration parameters of the defense mechanism are encoded into chromosomes in the genetic algorithm; An initial population containing multiple chromosomes is randomly generated, with each chromosome representing a defense strategy. Each chromosome is evaluated based on abnormal sample data, and the abnormal sample pass rate is obtained by dividing the number of abnormal samples that are misclassified as normal by the total number of abnormal samples. Based on the abnormal sample pass rate, a portion of chromosomes are selected as parents using a roulette wheel to generate the next generation population; By generating the next generation population, a crossover operation is performed based on the selected parent chromosome to generate new offspring chromosomes; Based on the new offspring chromosomes, random variations are introduced by performing mutation operations on a portion of the offspring chromosomes; Repeat the above steps until the maximum number of iterations is reached, select the chromosome with the highest fitness value, and decode it as a defense strategy.

[0012] Secondly, a server process defense system includes: The acquisition module is used to acquire multi-dimensional runtime parameter data of the server process; The module is used to build a training dataset containing known normal state samples and abnormal state samples based on historical multi-dimensional operating parameter data; based on the training dataset, the K-nearest neighbor algorithm is used to perform preliminary anomaly detection on the acquired multi-dimensional operating parameter data to obtain preliminary abnormal sample data; The processing module is used to calculate the similarity between preliminary abnormal sample data and known normal state samples to obtain a similarity value; set a similarity threshold and compare the similarity value with the similarity threshold to identify abnormal sample data; optimize the configuration parameters of the defense mechanism based on the abnormal sample data through a genetic algorithm to obtain a defense strategy; dynamically adjust the defense strategy and execute the defense to achieve server process defense.

[0013] Thirdly, a computing device, comprising: One or more processors; A storage device for storing one or more programs that, when executed by one or more processors, cause the one or more processors to implement the method.

[0014] Fourthly, a computer-readable storage medium storing a program that, when executed by a processor, implements the method.

[0015] The above-described solution of the present invention has at least the following beneficial effects: By monitoring multi-dimensional operating parameters of server processes, such as CPU utilization and memory usage, the overall running status of processes can be reflected, providing a rich data foundation for anomaly detection. Multi-dimensional data helps to more accurately locate abnormal behavior, reducing the possibility of false positives and false negatives. Using historical multi-dimensional operating parameter data to build a training dataset can make full use of historical experience and improve the accuracy of anomaly detection. Using the K-nearest neighbor algorithm to perform preliminary anomaly detection on multi-dimensional operating parameter data can quickly screen out potential abnormal samples. By calculating the similarity between preliminary abnormal sample data and known normal state samples, abnormal samples can be identified more accurately, reducing false judgments. Encoding the configuration parameters of the defense mechanism into chromosomes in a genetic algorithm can utilize the global search capability of the genetic algorithm to optimize the defense strategy and dynamically adjust the defense strategy, enabling the defense system to continuously learn and adapt to new attack patterns, thereby improving the intelligence level of the defense. Attached Figure Description

[0016] Figure 1 This is a flowchart illustrating a server process defense method provided by an embodiment of the present invention.

[0017] Figure 2 This is a schematic diagram of a server process defense system provided by an embodiment of the present invention. Detailed Implementation

[0018] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

[0019] like Figure 1 As shown, an embodiment of the present invention proposes a server process defense method, the method comprising the following steps: Step 11: Obtain multi-dimensional runtime parameter data of the server process; Step 12: Based on historical multi-dimensional operating parameter data, construct a training dataset containing known normal state samples and abnormal state samples; Step 13: Based on the training dataset, perform preliminary anomaly detection on the acquired multi-dimensional running parameter data using the K-nearest neighbor algorithm to obtain preliminary anomaly sample data; Step 14: Calculate the similarity between the preliminary abnormal sample data and the known normal state samples to obtain the similarity value; Step 15: Set a similarity threshold and compare the similarity values ​​with the similarity threshold to identify abnormal sample data; Step 16: Based on the abnormal sample data, optimize the configuration parameters of the defense mechanism using a genetic algorithm to obtain the defense strategy; Step 17: Dynamically adjust the defense strategy and execute the defense to achieve server process defense.

[0020] In this embodiment of the invention, by collecting multi-dimensional operating parameters such as CPU utilization, memory usage, and network traffic, a comprehensive behavioral profile of the server process is constructed, avoiding false negatives or missed positives caused by a single indicator. Multi-dimensional data combined with historical states accurately identifies abnormal patterns, enabling preliminary anomaly detection (K-NN). Unsupervised learning quickly identifies potential abnormal samples, reducing computational complexity. By calculating the similarity between abnormal and normal samples, the authenticity of the anomaly is further confirmed, preventing normal behavior from being misjudged. The similarity threshold is dynamically adjusted based on historical data to adapt to different server environments. A genetic algorithm searches for optimal defense configuration parameters to improve the effectiveness of the strategy.

[0021] Reinforcement learning dynamically adjusts defense strategies based on real-time attack feedback. For example, it strengthens the current strategy when an attack is successfully blocked, adjusts the strategy to reduce interference when there are false positives, and triggers a stricter detection mechanism when an attack is missed. From anomaly detection to strategy optimization and defense execution, a complete closed loop is formed, continuously improving defense capabilities. By dynamically adjusting strategies, it effectively responds to changes in attacker strategies, processes only new data, and reduces computational overhead through dimensionality reduction techniques, making it suitable for high-concurrency server environments.

[0022] In a preferred embodiment of the present invention, step 11 above may include: Step 111: Based on the characteristics of the monitored server processes, define the multi-dimensional operating parameter indicators to be collected, including CPU utilization, memory usage, etc. Step 112: Configure the data collection frequency based on multi-dimensional operating parameter indicators; Step 113: Based on the data acquisition frequency, obtain multi-dimensional operating parameter data by deploying a data acquisition agent; Step 114: Store the collected multi-dimensional operating parameter data in the database to obtain multi-dimensional operating parameter data.

[0023] In this embodiment of the invention, targeted data collection indicators are defined based on the unique behavior patterns of server processes to avoid collecting irrelevant data, reduce noise interference, and dynamically adjust the collection frequency according to the importance and frequency of change of the indicators. This maintains high sensitivity for key indicators while reducing the overhead of non-key indicators. Frequency configuration avoids server performance degradation caused by high-frequency collection, ensuring that the defense system itself does not become a performance bottleneck. A lightweight data collection agent is used to achieve real-time data capture with minimal resource overhead, supporting high-concurrency scenarios. The agent can be deployed on multiple server nodes, supporting distributed data collection, and is suitable for cloud computing or large-scale cluster environments. The collected data is stored in a database, supporting long-term storage and historical backtracking, providing sufficient samples for building training datasets.

[0024] In a specific embodiment of the present invention, the specific steps include: Step 111: Determine the process type and configuration parameters, observe the process's resource usage patterns, periodic tasks, and external dependencies, select key indicators such as CPU utilization and memory usage, and determine the priority of the indicators.

[0025] Step 112: Divide the frequency into high frequency, medium frequency and low frequency, and automatically adjust according to the system load. Reduce the frequency of non-critical indicators when the load is high, and temporarily increase the frequency of critical indicators when a potential anomaly is detected.

[0026] Step 113: Select the Telegraf proxy tool, which supports multi-metric collection and format conversion, and achieves kernel-level efficient collection. Run the proxy process on the target server to directly collect local metrics. Deploy the proxy through a batch management tool to centrally aggregate the data. The proxy reads the metrics according to the configuration and formats the data into a unified structure.

[0027] Step 114: Select a time series database, optimize time series data storage and query, define fields including timestamp, process ID, indicator name, and indicator value, partition by time or process ID to improve query efficiency, write directly to the database through a proxy, enable data compression, and set data retention policies.

[0028] In a preferred embodiment of the present invention, step 12 above may include: Step 121: By identifying historical multi-dimensional operating parameter data, labeling the data status, and distinguishing between normal and abnormal states; Step 122: Based on the data status labels, preliminarily filter the normal status samples and the abnormal status samples; Step 123: By filtering normal state samples and abnormal state samples, adjusting the ratio of the normal state sample set and the abnormal state sample set, and merging the normal and abnormal sample sets, a complete training dataset is obtained.

[0029] In this embodiment of the invention, through annotation and screening, the training data is ensured to cover both normal and abnormal scenarios, avoiding the learning of a single pattern. The balanced sample ratio reduces data bias, making the model more sensitive to the minority class (abnormality). The detection accuracy is improved in unknown attack or failure scenarios. Multi-dimensional data (such as CPU, memory, network) provides rich context. The merged dataset contains multiple anomaly types. Preliminary screening reduces irrelevant data and lowers computational overhead. The sample ratio adjustment avoids the model overfitting to the majority class. The label annotation can be updated regularly to reflect the latest threat patterns.

[0030] In a specific embodiment of the present invention, the specific steps include: Step 121: Collect historical multi-dimensional running parameter data, ensuring that the data includes key fields such as timestamp, process ID, and indicator value. Set static and dynamic thresholds, use the Python tool to traverse the data, and label the status according to the rules.

[0031] Step 122: Divide the labeled data into two sets: the normal state sample set and the abnormal state sample set. Remove duplicate data and count the number of normal and abnormal samples in the sample distribution.

[0032] Step 123: Determine whether the ratio needs to be adjusted by the ratio of normal to abnormal samples. Merge the adjusted normal and abnormal samples to form a complete training dataset. Check whether the label distribution of the merged dataset is uniform to ensure that the data is free of duplication and missing values.

[0033] In a preferred embodiment of the present invention, step 13 above may include: Step 131: Based on the training dataset, select a K value, and then... The distance between the sample to be detected and the training samples is calculated, where, This is the sample to be tested. These are training samples. It is the dimension of the feature vector. It is the first dimensional features, It is local density. It is the Minkowski distance. It is an index of the feature dimension; Step 132: Based on the calculated distance, select the K nearest training samples and count the state labels of the K nearest neighbor samples; Step 133: By statistically analyzing the status labels, anomaly judgment thresholds are set, and multi-dimensional operating parameter data are compared with the thresholds to preliminarily judge the sample anomalies and form a preliminary abnormal sample dataset.

[0034] In this embodiment of the invention, the Minkowski distance adapts to different scenarios, enhances the sensitivity of local density information to sparse regions, avoids misjudging low-density normal samples as abnormal, relies only on nearest neighbor samples, reduces global noise interference, and when detecting time series anomalies, nearest neighbor samples can better reflect the current trend. The threshold is dynamically adjusted to adapt to different scenarios, and the joint distribution of multi-dimensional features (such as CPU, memory, network) is combined to reduce misjudgment of a single dimension.

[0035] In a specific embodiment of the present invention, the specific steps include: Step 131: Select the K value, calculate the Minkowski distance between the sample to be detected and the training sample using the above formula, and combine it with local density information to quantify the similarity between samples.

[0036] Step 132: Sort by distance, select K nearest neighbor samples, and statistically analyze the distribution of their state labels.

[0037] Step 133: Based on the label statistics of the K nearest neighbor samples, set the anomaly judgment threshold to form a preliminary abnormal sample dataset.

[0038] In a preferred embodiment of the present invention, step 14 above may include: Step 141: Based on the preliminary abnormal sample data and the known normal state sample data, calculate the similarity between a single preliminary abnormal sample and all normal samples. The numerical range is [−1,1], and the closer to 1, the stronger the linear correlation. Step 142: By summarizing the similarity values ​​between the obtained single preliminary abnormal sample and all normal samples, a set of similarity values ​​is formed. Step 143: Select a similarity summary statistic to represent the initial similarity between abnormal samples and normal samples from the set of similarity values; Step 144: Based on the similarity summary statistic, calculate the similarity summary statistic of all preliminary abnormal samples using the above formula to obtain the preliminary abnormal sample data.

[0039] In this embodiment of the invention, a refined analysis of preliminary abnormal samples is achieved through Pearson coefficient similarity calculation, statistical summarization, and global anomaly assessment. Its core value lies in quantifying the degree of anomaly, supporting dynamic optimization, avoiding the random influence of a single normal sample, reflecting the difference between abnormal samples and the overall normal pattern, being suitable for scenarios where normal samples are evenly distributed, reflecting the overall similarity level, reducing computational complexity by replacing the full amount of data with statistical measures, and directly quantifying the degree of deviation between abnormal samples and the normal pattern, which facilitates the interpretation of results.

[0040] In a specific embodiment of the present invention, the specific steps include: Step 141: Based on the preliminary abnormal sample data and the known normal state sample data, calculate the similarity between a single preliminary abnormal sample and all normal samples using the above formula.

[0041] Step 142: Summarize the similarity values ​​of a single preliminary abnormal sample with all normal samples to obtain a set of summed similarity values.

[0042] Step 143: Select a statistic from the set of similarity values ​​to represent the overall similarity between the initial abnormal sample and the normal sample.

[0043] Step 144: Repeat steps 141-143 for all preliminary abnormal samples to obtain a set of similarity statistics for each sample.

[0044] In a preferred embodiment of the present invention, step 15 above may include: Step 151: Using preliminary abnormal sample data, set a similarity threshold to distinguish between normal samples and abnormal samples; Step 152: Based on the set similarity threshold, compare the summation statistics of the similarity of each preliminary abnormal sample with the threshold and mark it as normal or abnormal. Step 153: The preliminary abnormal samples marked as abnormal are integrated into an abnormal sample list to obtain abnormal sample data.

[0045] In this embodiment of the invention, the threshold can be dynamically adjusted according to the data distribution to adapt to the characteristics of different datasets. In network security, a stricter threshold can be set according to the similarity distribution of historical attack data to capture new types of attacks. Quick classification can be achieved through simple numerical comparison, which is suitable for large-scale data. The threshold setting can be adjusted according to business needs to balance detection sensitivity and false alarm rate. It provides high-quality abnormal sample data. The abnormal list can directly trigger alarms or automated processing procedures and automatically trigger resource isolation, realizing efficient classification and centralized management of preliminary abnormal samples.

[0046] In a specific embodiment of the present invention, the specific steps include: Step 151: Obtain the set of similarity statistics of all preliminary abnormal samples from step 144, set a fixed threshold, test the detection effect under different thresholds on the validation set, select the optimal threshold, and distinguish between normal samples and abnormal samples.

[0047] Step 152: Compare the summation statistics of the similarity of each preliminary abnormal sample with the threshold, obtain the similarity statistics of each sample, and mark it as normal or abnormal.

[0048] Step 153: Integrate the preliminary abnormal samples that have been marked as abnormal into an abnormal sample list. Extract all samples marked as abnormal from the marking result list, store the abnormal samples and their features into the list, and add information such as similarity statistics and original index to the list.

[0049] In a preferred embodiment of the present invention, step 16 above may include: Step 161: Based on the abnormal sample data, encode the configuration parameters of the defense mechanism into chromosomes in the genetic algorithm; Step 162: Randomly generate an initial population containing multiple chromosomes, each chromosome representing a defense strategy. Evaluate each chromosome based on the abnormal sample data. Obtain the abnormal sample pass rate by dividing the number of abnormal samples misclassified as normal by the total number of abnormal samples. Step 163: Based on the abnormal sample pass rate, select a portion of chromosomes as parents using roulette wheel selection to generate the next generation population; Step 164: Using the generated next generation population, perform a crossover operation based on the selected parent chromosome to generate new offspring chromosomes; Step 165: Based on the new offspring chromosomes, random variations are introduced by performing mutation operations on a portion of the offspring chromosomes; Step 166: Repeat the above operation until the maximum number of iterations is reached, select the chromosome with the highest fitness value, and decode it as a defense strategy.

[0050] In this embodiment of the invention, complex defense strategy parameters are transformed into optimizable chromosomes. An initial population is randomly generated, with each chromosome representing a defense strategy. Randomly generating the initial population ensures strategy diversity, covering a wider parameter space. The pass rate of common samples directly reflects the effectiveness of the defense strategy, facilitating comparison and selection. A roulette wheel is used to select the parent strategy, accelerating convergence to the optimal solution. Crossover operations combine the advantages of the parent strategy to generate better child strategies. In malware detection, signature-based and behavior-based detection strategies are integrated. Mutation operations break the current solution pattern, avoiding getting trapped in local optima. Through multiple iterations, the optimal solution is gradually approached.

[0051] In a specific embodiment of the present invention, the specific steps include: Step 161: Clarify the key parameters of the defense mechanism, such as detection threshold, rule weight, time window size, etc., and their value range. Select binary encoding, directly use real number vectors to represent the parameters, and combine all parameters in order into a chromosome.

[0052] Step 162: Randomly generate N chromosomes, each representing a defense strategy. For each chromosome, evaluate its performance using abnormal sample data and calculate the abnormal sample pass rate using the formula above.

[0053] Step 163: Calculate the outlier pass rate using the formula above, and then... Calculate the probability of each chromosome being selected, where, It is the probability of a chromosome being selected. This is the fitness value of the chromosome, where N is the total number of chromosomes in the population. 'b' is the index for traversing the population, and 'b' is the index of the current chromosome. The parent chromosome is selected based on roulette wheel selection to generate the next generation.

[0054] Step 164: Randomly select a crossover point, exchange some genes of the parent chromosome, and randomly select each gene locus from the parent with a certain probability. Perform crossover on the selected parent chromosomes to generate offspring chromosomes.

[0055] Step 165: The random chromosome flipping operation introduces random changes, which mutate the offspring chromosomes with a certain probability.

[0056] Step 166: Repeat steps 162-165 until the maximum number of iterations is reached. In the final population, select the chromosome with the highest fitness value and decode the optimal chromosome into specific defense strategy parameters.

[0057] In a preferred embodiment of the present invention, step 17 above may include: Step 171: By defining the defense environment and state space, the action space is obtained based on the operations that can be taken in the server process defense. Step 172: Using the obtained action space, define a reward function. Successfully preventing an attack will result in a positive reward, misjudging normal behavior as an attack will result in a negative reward, failing to detect an attack will result in a negative reward, and actions that do not affect the system state will result in a zero reward. Step 173: Based on the defined reward function, create a Q table to store the Q value corresponding to each state action; Step 174: The dynamic defense strategy is obtained by adding the current Q value to the learning rate multiplied by the immediate reward multiplied by the discount factor multiplied by the maximum Q value among all possible actions in the next state, and then subtracting the current Q value. Step 175: The extracted optimal strategy is applied to the server process defense system, and the defense measures are adjusted in real time to achieve server process defense. In this embodiment of the invention, by defining the defense environment, the boundaries and conditions of server process defense are clarified, avoiding resource waste or defense blind spots. Based on the available operations, an action space is constructed, making the defense strategy more operable. The design of the state space can reflect the real-time state of the server process, enabling the defense system to dynamically respond to threats. Successfully blocking attacks is rewarded, encouraging the defense system to take effective actions first. The Q-table records the Q-value of each state-action pair, reflecting long-term accumulated defense experience. Through the Q-table, the system can quickly select the optimal action, improving defense efficiency.

[0058] In a specific embodiment of the present invention, the specific steps include: Step 171: Define the boundaries and conditions of server process defense, such as: which server processes to monitor, the target of defense, and the possible states of server processes, such as: CPU utilization, memory usage, abnormal network traffic, etc. Based on the available operations, construct the action space, such as: allowing the process to run, terminating the process, restricting network access, isolating the process, etc.

[0059] Step 172: Define a reward function based on the defense target. Successfully blocking an attack will result in a positive reward, with the reward value increasing by 10. If normal behavior is mistakenly identified as an attack, a negative reward will be given, with the reward value decreasing by 5. If an attack is not detected, a negative reward will be given. If the action does not affect the system state, a zero reward will be given, with the reward value being 0.

[0060] Step 173: Create a Q table with an initial value of 0. Each cell stores the long-term cumulative reward for actions taken in a given state.

[0061] Step 174: Based on the current Q value, calculate the dynamically adjusted defense strategy using the above formula.

[0062] Step 175: For each state, select the action with the largest Q value, apply the optimal strategy to the server process defense system, continuously monitor the system status, and dynamically adjust the defense measures according to the new state.

[0063] like Figure 2 As shown, embodiments of the present invention also provide a server process defense system 20, comprising: Module 21 is used to acquire multi-dimensional runtime parameter data of the server process; Module 22 is used to construct a training dataset containing known normal state samples and abnormal state samples based on historical multi-dimensional operating parameter data; based on the training dataset, the K-nearest neighbor algorithm is used to perform preliminary anomaly detection on the acquired multi-dimensional operating parameter data to obtain preliminary abnormal sample data; The processing module 23 is used to calculate the similarity between preliminary abnormal sample data and known normal state samples to obtain a similarity value; set a similarity threshold and compare the similarity value with the similarity threshold to identify abnormal sample data; optimize the configuration parameters of the defense mechanism through a genetic algorithm based on the abnormal sample data to obtain a defense strategy; dynamically adjust the defense strategy and execute the defense to achieve server process defense.

[0064] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A server process defense method, characterized in that, The method includes: Obtain multi-dimensional runtime parameter data of the server process; Based on historical multi-dimensional operating parameter data, a training dataset containing known normal state samples and abnormal state samples is constructed. Based on the training dataset, the K-nearest neighbor algorithm is used to perform preliminary anomaly detection on the acquired multi-dimensional running parameter data to obtain preliminary anomaly sample data; The similarity value is obtained by calculating the similarity between the preliminary abnormal sample data and the known normal state samples; Set a similarity threshold and compare the similarity value with the similarity threshold to identify abnormal sample data; Based on abnormal sample data, a genetic algorithm is used to optimize the configuration parameters of the defense mechanism to obtain a defense strategy, including: Based on the abnormal sample data, the configuration parameters of the defense mechanism are encoded into chromosomes in the genetic algorithm; An initial population containing multiple chromosomes is randomly generated, with each chromosome representing a defense strategy. Each chromosome is evaluated based on abnormal sample data, and the abnormal sample pass rate is obtained by dividing the number of abnormal samples that are misclassified as normal by the total number of abnormal samples. Based on the abnormal sample pass rate, a portion of chromosomes are selected as parents using a roulette wheel to generate the next generation population; By generating the next generation population, a crossover operation is performed based on the selected parent chromosome to generate new offspring chromosomes; Based on the new offspring chromosomes, random variations are introduced by performing mutation operations on a portion of the offspring chromosomes; Repeat the above steps until the maximum number of iterations is reached, select the chromosome with the highest fitness value, and decode it as a defense strategy. Dynamically adjust and execute defense strategies to achieve server process protection.

2. The server process defense method according to claim 1, characterized in that, Obtain multi-dimensional runtime parameter data of the server process, including: By monitoring server processes, and based on process characteristics, we define and collect multi-dimensional operational parameter metrics, including CPU utilization and memory usage. Configure the data collection frequency based on multi-dimensional operating parameter indicators; Based on the data collection frequency, multi-dimensional operating parameter data is obtained by deploying a data collection agent; The collected multi-dimensional operating parameters are stored in the database to obtain multi-dimensional operating parameter data.

3. The server process defense method according to claim 2, characterized in that, Based on historical multi-dimensional operational parameter data, a training dataset containing known normal state samples and abnormal state samples is constructed, including: By identifying historical multi-dimensional operational parameter data and labeling data status, normal and abnormal states can be distinguished. Based on the data status labels, samples in normal state and samples in abnormal state are initially screened. By filtering normal and abnormal state samples, adjusting the ratio of normal and abnormal state sample sets, and merging the normal and abnormal sample sets, a complete training dataset is obtained.

4. The server process defense method according to claim 3, characterized in that, Based on the training dataset, the K-nearest neighbor algorithm is used to perform preliminary anomaly detection on the acquired multi-dimensional operating parameter data, resulting in preliminary anomaly sample data, including: Based on the training dataset, select a K value, calculate the difference between the test sample and the training sample in each feature dimension, divide the difference in each feature dimension by a quantity related to the sum of the differences in all feature dimensions, apply the Minkowski distance formula to the adjusted difference, sum the distances in all dimensions, and take the result. The power of this power yields the distance between the sample to be tested and the training samples; Based on the calculated distance, select the K nearest training samples and calculate the state labels of the K nearest neighbor samples; By statistically analyzing status labels and setting anomaly detection threshold, multi-dimensional operational parameter data are compared with the threshold to preliminarily determine sample anomalies and form a preliminary abnormal sample dataset.

5. The server process defense method according to claim 4, characterized in that, The similarity value is obtained by calculating the similarity between preliminary abnormal sample data and known normal state samples, including: Based on the preliminary abnormal sample data and the known normal sample data, the similarity between a single preliminary abnormal sample and all normal samples is calculated. The similarity is a Pearson correlation with a value range of [-1, 1]. A value closer to 1 indicates a stronger linear correlation. By summing the similarity scores between a single preliminary abnormal sample and all normal samples, a set of similarity scores is formed. By using a set of similarity values, a summary similarity statistic is selected to represent the initial similarity between abnormal samples and normal samples; Based on the summative similarity statistics, calculate the summative similarity statistics for all preliminary abnormal samples to obtain the preliminary abnormal sample data.

6. The server process defense method according to claim 5, characterized in that, Set a similarity threshold and compare the similarity values ​​with the threshold to identify anomalous sample data, including: By using preliminary abnormal sample data, a similarity threshold is set to distinguish between normal and abnormal samples; Based on the set similarity threshold, the summation statistics of the similarity of each preliminary abnormal sample are compared with the threshold, and marked as normal or abnormal. The initial abnormal samples that are marked as abnormal are integrated into an abnormal sample list to obtain abnormal sample data.

7. A server process defense system, wherein the system implements the method as described in any one of claims 1 to 6, characterized in that, include: The acquisition module is used to acquire multi-dimensional runtime parameter data of the server process; The building module is used to construct a training dataset containing known normal state samples and abnormal state samples based on historical multi-dimensional running parameter data; Based on the training dataset, the K-nearest neighbor algorithm is used to perform preliminary anomaly detection on the acquired multi-dimensional running parameter data to obtain preliminary anomaly sample data; The processing module is used to calculate the similarity between preliminary abnormal sample data and known normal state samples to obtain a similarity value; set a similarity threshold and compare the similarity value with the similarity threshold to identify abnormal sample data; optimize the configuration parameters of the defense mechanism based on the abnormal sample data through a genetic algorithm to obtain a defense strategy; dynamically adjust the defense strategy and execute the defense to achieve server process defense.

8. A computing device, characterized in that, include: One or more processors; A storage device for storing one or more programs that, when executed by one or more processors, cause the one or more processors to implement the method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a program that, when executed by a processor, implements the method as described in any one of claims 1 to 6.

Images