Operation and maintenance risk management method and device of cloud platform and storage medium

Abstract

The invention discloses an operation and maintenance risk management method and device of a cloud platform and a storage medium. The method comprises the following steps: acquiring to-be-analyzed data in a running process of a cloud platform; performing anomaly detection on the performance index data, identifying abnormal data, and identifying abnormal log information in the operation log information according to the abnormal data; determining a target abnormal event based on the abnormal data and the abnormal log information; calculating the similarity between the first feature vector and the second feature vector; determining whether the abnormal data belongs to a target abnormal event or not according to the similarity; and under the condition that the abnormal data belongs to the target abnormal event, generating a first security policy corresponding to the target abnormal event, and executing the first security policy. Through the method and the device, the problem that the operation stability of the cloud platform is poor due to the fact that the detection accuracy of the abnormal event in the cloud platform is low in the related technology is solved.

Description

Technical Field

[0001] This application relates to the field of cloud computing, and more specifically, to a method, apparatus, and storage medium for managing the operation and maintenance risks of a cloud platform. Background Technology

[0002] In today's era of digital transformation, cloud platforms have become a crucial component of financial institutions' technical architecture. The dynamic and open nature of cloud environments presents unprecedented challenges to operations and maintenance (O&M) security management. Traditional O&M security strategies, often based on static rules and manual intervention, are inadequate in the face of massive, rapidly changing O&M data. For example, when a cloud platform encounters complex cyberattacks, traditional defenses may be ineffective due to slow response times and delayed rule updates. Furthermore, resource abuse caused by internal operational errors or malicious actions lacks the intelligent analysis and real-time response capabilities of traditional strategies, potentially leading to severe business disruptions and data breaches. Especially in the financial industry, the timeliness and complexity of data demand that O&M security systems be able to respond quickly and make accurate decisions.

[0003] There is currently no effective solution to the problem that the accuracy of detecting abnormal events in cloud platforms is low, resulting in poor operational stability of cloud platforms. Summary of the Invention

[0004] The main purpose of this application is to provide a method, device and storage medium for cloud platform operation and maintenance risk management, so as to solve the problem that the accuracy of abnormal event detection in cloud platforms is low, resulting in poor operation stability of cloud platforms.

[0005] To achieve the above objectives, according to one aspect of this application, a method for managing operational risks of a cloud platform is provided. The method includes: collecting data to be analyzed during the operation of the cloud platform, wherein the data to be analyzed includes at least operational log information and performance indicator data during the operation of the cloud platform; performing anomaly detection on the performance indicator data to identify abnormal data, and identifying abnormal log information in the operational log information based on the abnormal data, wherein the abnormal log information is the log information corresponding to the abnormal data; determining a target abnormal event based on the abnormal data and the abnormal log information; calculating the similarity between a first feature vector and a second feature vector, wherein the first feature vector is a vector representation of the abnormal data and the abnormal log information, and the second feature vector is a vector representation of the target abnormal event; determining whether the abnormal data belongs to the target abnormal event based on the similarity; and, if the abnormal data belongs to the target abnormal event, generating a first security policy corresponding to the target abnormal event and executing the first security policy.

[0006] Optionally, determining the target anomalous event based on anomalous data and anomalous log information includes: inputting the anomalous data and anomalous log information into the target model, wherein the target model is a model trained based on training data and the anomalous events corresponding to the training data, and the training data is known anomalous data; and outputting the target anomalous event through the target model.

[0007] Optionally, before calculating the similarity between the first feature vector and the second feature vector, the method includes: extracting abnormal feature information from abnormal data and abnormal log information; and generating the first feature vector based on the abnormal feature information.

[0008] Optionally, calculating the similarity between the first eigenvector and the second eigenvector includes: calculating the vector dot product of the first eigenvector and the second eigenvector; calculating the first vector norm of the first eigenvector and the second vector norm of the second eigenvector; and calculating the cosine similarity between the first eigenvector and the second eigenvector based on the vector dot product, the first vector norm, and the second vector norm.

[0009] Optionally, the performance index data includes numerical performance index data. Anomaly detection is performed on the performance index data to identify abnormal data, including: using the isolated forest algorithm to identify abnormal data in the numerical performance index data, wherein abnormal data are data points that deviate from a preset range.

[0010] Optionally, after collecting the data to be analyzed during the operation of the cloud platform, the method further includes: cleaning the data to be analyzed to obtain cleaned data; converting the cleaned data to obtain data in a uniform format; and normalizing the numerical data in the uniform format data to obtain preprocessed data.

[0011] Optionally, when the abnormal data is a target abnormal event, generating a first security policy corresponding to the target abnormal event and executing the first security policy includes: monitoring the execution effect of the first security policy and recording security indicator data; calculating the reward value of the first security policy based on the security indicator data; adjusting the first security policy based on the reward value to obtain the target security policy, and executing the target security policy.

[0012] To achieve the above objectives, according to another aspect of this application, a cloud platform operation and maintenance risk management device is provided. The device includes: a data acquisition unit for acquiring data to be analyzed during the operation of the cloud platform, wherein the data to be analyzed includes at least operation log information and performance indicator data during the operation of the cloud platform; an identification unit for performing anomaly detection on the performance indicator data, identifying abnormal data, and identifying abnormal log information in the operation log information based on the abnormal data, wherein the abnormal log information is the log information corresponding to the abnormal data; a first determination unit for determining a target abnormal event based on the abnormal data and the abnormal log information; a calculation unit for calculating the similarity between a first feature vector and a second feature vector, wherein the first feature vector is a vector representation of the abnormal data and the abnormal log information, and the second feature vector is a vector representation of the target abnormal event; a second determination unit for determining whether the abnormal data belongs to the target abnormal event based on the similarity; and an execution unit for generating a first security policy corresponding to the target abnormal event and executing the first security policy if the abnormal data belongs to the target abnormal event.

[0013] Optionally, the first determining unit includes: an input model, used to input abnormal data and abnormal log information into a target model, wherein the target model is a model trained based on training data and the abnormal events corresponding to the training data, and the training data is known abnormal data; and an output model, used to output the target abnormal event through the target model.

[0014] Optionally, the apparatus includes: an extraction unit for extracting abnormal feature information from abnormal data and abnormal log information before calculating the similarity between the first feature vector and the second feature vector; and a generation unit for generating the first feature vector based on the abnormal feature information.

[0015] Optionally, the calculation unit includes: a first calculation module for calculating the vector dot product of the first eigenvector and the second eigenvector; a second calculation module for calculating the first vector norm of the first eigenvector and the second vector norm of the second eigenvector; and a third calculation module for calculating the cosine similarity between the first eigenvector and the second eigenvector based on the vector dot product, the first vector norm, and the second vector norm.

[0016] Optionally, the identification unit includes: an identification module, used to identify abnormal data in the numerical performance index data, which includes numerical performance index data, using an isolated forest algorithm, wherein the abnormal data are data points that deviate from a preset range.

[0017] Optionally, the device further includes: a cleaning unit for cleaning the data to be analyzed after the data to be analyzed is collected during the operation of the cloud platform, to obtain cleaned data; a conversion unit for converting the format of the cleaned data to obtain data in a uniform format; and a processing unit for normalizing the numerical data in the uniform format data to obtain preprocessed data.

[0018] Optionally, the execution unit includes: a monitoring module for monitoring the execution effect of the first security policy and recording security indicator data; a fourth calculation module for calculating the reward value of the first security policy based on the security indicator data; and an adjustment module for adjusting the first security policy based on the reward value to obtain the target security policy and executing the target security policy.

[0019] According to another aspect of this application, a computer-readable storage medium is provided, which includes a stored program, wherein, when the program is running, it controls the device where the computer-readable storage medium is located to execute an operation and maintenance risk management method for any cloud platform.

[0020] According to another aspect of this application, an electronic device is provided, comprising: one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs include an operation and maintenance risk management method for executing any cloud platform.

[0021] According to another aspect of this application, a computer program product is provided, including computer instructions, which, when executed by a processor, implement the steps of the cloud platform operation and maintenance risk management method described above.

[0022] In this embodiment, by collecting data to be analyzed during the operation of a cloud platform, including at least operation log information and performance index data, anomaly detection is performed on the performance index data to identify abnormal data, and abnormal log information in the operation log information is identified based on the abnormal data. The abnormal log information is the log information corresponding to the abnormal data. A target abnormal event is determined based on the abnormal data and the abnormal log information. The similarity between a first feature vector and a second feature vector is calculated, where the first feature vector is a vector representation of the abnormal data and the abnormal log information, and the second feature vector is a vector representation of the target abnormal event. Whether the abnormal data belongs to the target abnormal event is determined based on the similarity. If the abnormal data belongs to the target abnormal event, a first security policy corresponding to the target abnormal event is generated and executed. This solves the technical problem of low accuracy in detecting abnormal events in the cloud platform, leading to poor operational stability of the cloud platform. According to this application, data to be analyzed during the operation of a cloud platform is collected, abnormal data in performance index data and abnormal log information corresponding to the abnormal data are identified, target abnormal events are determined based on the abnormal data and abnormal log information, and whether the abnormal data belongs to the target abnormal time is determined based on the similarity between the first feature vector and the second feature vector. If it belongs to the target abnormal time, a first security policy is generated and executed, thereby achieving the technical effect of improving the operational stability of the cloud platform. Attached Figure Description

[0023] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0024] Figure 1 A hardware structure block diagram of a computer terminal for implementing a cloud platform operation and maintenance risk management method is shown.

[0025] Figure 2 This is a flowchart of a cloud platform operation and maintenance risk management method provided according to an embodiment of this application;

[0026] Figure 3 This is a schematic diagram of a cloud platform operation and maintenance risk management device provided according to an embodiment of this application;

[0027] Figure 4 This is a structural block diagram of an electronic device according to an embodiment of this application. Detailed Implementation

[0028] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0029] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0030] Example 1

[0031] According to an embodiment of this application, a method embodiment for cloud platform operation and maintenance risk management is also provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0032] The method embodiment provided in Embodiment 1 of this application can be executed on a mobile terminal, computer terminal, or similar computing device. Figure 1 A hardware structure block diagram of a computer terminal (or mobile device) for implementing an operational risk management method for a cloud platform is shown. Figure 1As shown, the computer terminal 10 (or mobile device) may include one or more processors 102 (shown as 102a, 102b, ..., 102n in the figure) 102 (processor 102 may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.), a memory 104 for storing data, and a transmission device 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a Universal Serial Bus (USB) port (which may be included as one of the ports of a BUS bus), a network interface, a power supply, and / or a camera. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the aforementioned electronic device. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0033] It should be noted that the aforementioned one or more processors 102 and / or other data processing circuits are generally referred to herein as "data processing circuits". These data processing circuits may be embodied, in whole or in part, in software, hardware, firmware, or any other combination thereof. Furthermore, the data processing circuits may be a single, independent processing module, or may be integrated, in whole or in part, into any other element within the computer terminal 10 (or mobile device). As involved in the embodiments of this application, the data processing circuits serve as a processor control mechanism (e.g., selection of a variable resistor termination path connected to an interface).

[0034] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the cloud platform operation and maintenance risk management method in this embodiment of the application. The processor 102 executes various functional applications and data processing by running the software programs and modules stored in the memory 104, thereby realizing the aforementioned cloud platform operation and maintenance risk management method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0035] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0036] The display can be, for example, a touchscreen liquid crystal display (LCD), which allows the user to interact with the user interface of the computer terminal 10 (or mobile device).

[0037] Under the aforementioned operating environment, this application provides the following: Figure 2 The cloud platform operation and maintenance risk management method is shown. Figure 2 This is a flowchart of a cloud platform operation and maintenance risk management method according to Embodiment 1 of this application.

[0038] Step S201: Collect the data to be analyzed during the operation of the cloud platform. The data to be analyzed includes at least the operation log information and performance index data during the operation of the cloud platform.

[0039] Optionally, the operations and maintenance system can use monitoring tools and interfaces to collect various data generated during the operation of the cloud platform (i.e., the data to be analyzed mentioned above) in real time or periodically. The data to be analyzed includes at least operation log information and performance indicator data. Operation log information records the operating status of various services and applications in the cloud platform, including but not limited to user operation records, system events, error messages, security alerts, etc.; performance indicator data reflects the operating performance of the cloud platform, such as CPU utilization, memory usage, network traffic, etc.

[0040] Step S202: Perform anomaly detection on the performance index data, identify abnormal data, and identify abnormal log information in the operation log information based on the abnormal data. The abnormal log information is the log information corresponding to the abnormal data.

[0041] Optionally, anomaly detection involves analyzing performance metrics data to identify data points that deviate from normal operating patterns; these data points are considered anomalous. For example, the Isolation Forest algorithm can be used for anomaly detection. Once anomalous data is identified, the system further analyzes operational log information from the same time point or time period as the anomalous data, filtering out anomalous log information related to the anomalous data. This process can be combined with natural language processing techniques to extract key features from the anomalous log text to identify potential security events.

[0042] Step S203: Determine the target abnormal event based on abnormal data and abnormal log information.

[0043] Optionally, the target anomalous event represented by these anomalous data and log information can be determined using a target model. For example, if the anomalous data reflects a sudden surge in network traffic, and the anomalous log information contains a large number of connection attempts from external IPs, the target model can determine that the target anomalous event is a distributed denial-of-service attack.

[0044] Step S204: Calculate the similarity between the first feature vector and the second feature vector, where the first feature vector is a vector representation of the abnormal data and abnormal log information, and the second feature vector is a vector representation of the target abnormal event.

[0045] Optionally, the first feature vector is obtained by feature extraction and vectorization of abnormal data and abnormal log information, reflecting the characteristics of the current abnormal event. The second feature vector is the vector representation of the target abnormal event and is stored in the system as a template. By calculating the similarity between the first and second feature vectors, the degree of similarity between the current abnormal event and known events can be quantified. Cosine similarity can be used as a metric, which can effectively measure the directional relationship between two vectors in high-dimensional space, serving as an important basis for identifying event types and assessing event severity.

[0046] Step S205: Determine whether the abnormal data belongs to the target abnormal event based on the similarity.

[0047] Optionally, based on the similarity between the first feature vector and the second feature vector, it can be determined whether the current abnormal data matches a known target abnormal event. If the similarity exceeds a preset threshold, the current abnormal data can be considered to belong to the target abnormal event.

[0048] Step S206: If the abnormal data belongs to the target abnormal event, generate the first security policy corresponding to the target abnormal event and execute the first security policy.

[0049] Optionally, once it is determined that the abnormal data belongs to a target abnormal event, a primary security policy can be generated to address that event. This primary security policy includes, but is not limited to, adjustments to firewall rules, changes to access control permissions, restarting or shutting down system services, and data backup and recovery. For example, for an event determined to be a distributed denial-of-service attack, the operations and maintenance system will generate and execute a primary security policy, such as adding firewall filtering rules to restrict access from abnormal IPs, thereby mitigating the impact of the attack on the cloud platform. After the primary security policy is executed, the system will continuously monitor its effectiveness and make adjustments as necessary to ensure the security and stability of the cloud platform.

[0050] The cloud platform operation and maintenance risk management method provided in this application embodiment collects data to be analyzed during the operation of the cloud platform, including at least operation log information and performance index data. It performs anomaly detection on the performance index data to identify abnormal data, and identifies abnormal log information in the operation log information based on the abnormal data. The abnormal log information corresponds to the abnormal data. Based on the abnormal data and abnormal log information, it determines a target abnormal event. It calculates the similarity between a first feature vector and a second feature vector, where the first feature vector is a vector representation of the abnormal data and abnormal log information, and the second feature vector is a vector representation of the target abnormal event. It determines whether the abnormal data belongs to the target abnormal event based on the similarity. If the abnormal data belongs to the target abnormal event, it generates a first security policy corresponding to the target abnormal event and executes the first security policy. This method solves the technical problem of low accuracy in detecting abnormal events in the cloud platform, leading to poor operational stability of the cloud platform. According to this application, data to be analyzed during the operation of a cloud platform is collected, abnormal data in performance index data and abnormal log information corresponding to the abnormal data are identified, target abnormal events are determined based on the abnormal data and abnormal log information, and whether the abnormal data belongs to the target abnormal time is determined based on the similarity between the first feature vector and the second feature vector. If it belongs to the target abnormal time, a first security policy is generated and executed, thereby achieving the technical effect of improving the operational stability of the cloud platform.

[0051] To improve the accuracy of identifying abnormal events, optionally, in the cloud platform operation and maintenance risk management method provided in this application embodiment, determining the target abnormal event based on abnormal data and abnormal log information includes:

[0052] The first step is to input the abnormal data and abnormal log information into the target model. The target model is a model trained based on the training data and the abnormal events corresponding to the training data. The training data consists of known abnormal data.

[0053] Optionally, the target model described above is a machine learning model trained on a large amount of historical anomaly data and corresponding anomaly events. It can identify patterns and features in anomaly data and log information and map them to specific target anomaly events. The anomaly data and log information are first converted into an input format that the target model can understand, namely feature vectors. The target model receives these feature vectors as input and uses the weights and parameters learned during training to process and analyze the input data. This quickly matches the anomaly data and log information with known anomaly events, improving the efficiency and accuracy of security event identification.

[0054] The second step is to output the target abnormal event through the target model.

[0055] Optionally, after inputting abnormal data and abnormal log information, the target model uses its internal logic and algorithms to output the target abnormal event.

[0056] In summary, the above steps enable automatic diagnosis from raw data (i.e., abnormal data and abnormal log information) to the target abnormal event, reducing reliance on human experts and making the operation and maintenance security decision-making process more real-time and automated.

[0057] To accurately identify abnormal events corresponding to abnormal data and abnormal log information, optionally, in the cloud platform operation and maintenance risk management method provided in this application embodiment, before calculating the similarity between the first feature vector and the second feature vector, the method includes:

[0058] The first step is to extract abnormal feature information from abnormal data and abnormal log information.

[0059] Optionally, for abnormal data, the abnormal data information that can be extracted includes performance indicators such as peak CPU usage, peak network traffic, and hard disk read / write frequency; for abnormal log information, the abnormal feature information that can be extracted includes event features such as the number of login attempts, the IP addresses of failed login attempts, and the types of operation commands.

[0060] The second step is to generate the first feature vector based on the abnormal feature information.

[0061] Optionally, after the abnormal feature information is extracted, this abnormal feature information can be converted into a vector representation, i.e., the first feature vector. Vector representation is the standard input format for machine learning and deep learning models. The generation of the first feature vector can be based on feature encoding techniques, such as one-hot encoding, embedding encoding, numerical normalization, etc., to ensure that the feature vector has good numerical features and linear separability.

[0062] In summary, the first feature vector generated from the extracted abnormal feature information can accurately reflect the characteristics of abnormal data, providing a solid data foundation for subsequent similarity calculation and determination of abnormal event types.

[0063] To accurately quantify the similarity between the first feature vector and the second feature vector, optionally, in the cloud platform operation and maintenance risk management method provided in this application embodiment, calculating the similarity between the first feature vector and the second feature vector includes:

[0064] The first step is to calculate the dot product of the first and second eigenvectors.

[0065] Optionally, by calculating the dot product of the first and second eigenvectors, one can gain a preliminary understanding of the numerical correlation between the two vectors. The vector dot product is the first step in calculating cosine similarity, providing a basic value for quantifying the degree of numerical agreement between two vectors.

[0066] The second step is to calculate the first vector norm of the first eigenvector and the second vector norm of the second eigenvector.

[0067] Optionally, the lengths of the first and second eigenvectors can be obtained by calculating their norms, which is a necessary denominator in the cosine similarity calculation.

[0068] The third step is to calculate the cosine similarity between the first eigenvector and the second eigenvector based on the vector dot product, the first vector norm, and the second vector norm.

[0069] Optionally, the cosine similarity value ranges from -1 to 1. The closer the value is to 1, the closer the directions of the first and second feature vectors are, and the higher the similarity. The closer the value is to -1, the opposite the directions are. When the value is 0, it means that the two vectors are orthogonal, that is, completely unrelated.

[0070] In summary, by following the steps above and calculating the cosine similarity between the first and second feature vectors, we can quantitatively assess the similarity between anomalous data and the target anomalous event, and accurately determine the anomalous event corresponding to the anomalous data.

[0071] To improve the accuracy of abnormal data detection, optionally, in the cloud platform operation and maintenance risk management method provided in this application embodiment, the performance index data includes numerical performance index data. The abnormal data detection of the performance index data includes: using the isolated forest algorithm to identify abnormal data in the numerical performance index data, wherein the abnormal data is data points that deviate from the preset range.

[0072] Optionally, the Isolation Forest algorithm can improve the efficiency and accuracy of anomaly detection. The Isolation Forest algorithm is highly sensitive to anomalous data and can capture outliers at the edges of data distribution. For example, when monitoring the CPU utilization of a server, historical data shows that the server's CPU utilization typically fluctuates between 20% and 40%, occasionally reaching 50%. If the Isolation Forest algorithm detects that the server's CPU utilization suddenly rises to 80% within a specific time period, this data point will be considered an anomaly.

[0073] Optionally, in the cloud platform operation and maintenance risk management method provided in this application embodiment, after collecting the data to be analyzed during the operation of the cloud platform, the method further includes:

[0074] The first step is to clean the data to be analyzed, obtaining cleaned data.

[0075] Optionally, the goal of data cleaning is to remove or correct incomplete, incorrect, irrelevant, or duplicate data. Data cleaning involves several sub-steps, including identifying and deleting incomplete records or records containing null values, correcting incorrect formatting, filtering out outliers, and resolving data duplication issues.

[0076] The second step is to perform a format conversion operation on the cleaned data to obtain data in a unified format.

[0077] Optionally, data format conversion is the process of converting various types of data into a consistent format to facilitate subsequent processing and analysis. Since the data to be analyzed may come from different data sources with different formats and encoding methods, a unified format can ensure data consistency and comparability, making data analysis more efficient and accurate.

[0078] The third step is to normalize the numerical data in the unified format data to obtain the preprocessed data.

[0079] Optionally, normalization is a process that scales the range of numerical data to a standard interval, such as [0,1] or [-1, 1]. Normalization can eliminate the impact of differences in data magnitude on the analysis of anomalous events.

[0080] In summary, by performing data cleaning, data format standardization, and data normalization on the data to be analyzed through the above steps, clean, uniform, and standardized preprocessed data is obtained, providing a high-quality data foundation for subsequent analysis of anomalies.

[0081] Optionally, in the cloud platform operation and maintenance risk management method provided in this application embodiment, when the abnormal data is a target abnormal event, generating a first security policy corresponding to the target abnormal event and executing the first security policy includes:

[0082] The first step is to monitor the effectiveness of the primary security strategy and record security metrics data.

[0083] Optionally, by collecting various security-related metrics data, such as system response time, error rate, CPU and memory usage, network traffic, and other key indicators, the effectiveness of the first security policy can be quantified. For example, by comparing the changes in key security indicators before and after policy implementation, it can be determined whether the policy is effective, whether there are side effects, or whether further optimization is needed.

[0084] The second step is to calculate the reward value for the first security strategy based on the security indicator data.

[0085] Optionally, calculating the reward value of the first security policy is a quantitative way to evaluate the effectiveness of its implementation, reflecting the positive or negative impact of the first security policy on business operations while ensuring the security of the cloud platform. The reward value can be related to changes in security metric data, such as how many attacks the policy successfully prevented and which security metrics were improved, while also taking into account the impact on business performance, such as the increase in latency and whether there were false positives or false negatives.

[0086] The third step is to adjust the first security policy based on the reward value to obtain the target security policy, and then execute the target security policy.

[0087] Optionally, based on the feedback from the reward value, the security policy can be dynamically adjusted to optimize its balance between security and business performance. If the reward value is high, it indicates that the current policy is effective and no major adjustments are needed; if the reward value is low, it indicates that the policy may be too conservative (leading to impaired business performance) or too slack (failing to effectively prevent security incidents), and adjustments need to be made according to the specific circumstances.

[0088] Optionally, the first security strategy can be adjusted according to the current financial business. If the financial business has a wide impact (e.g., the entire industry), the security level of the first security strategy can be increased. If the financial business is an account-related business, the security level of the first security strategy can be increased.

[0089] In summary, by following the steps above and adjusting security policies based on reward feedback, the policies can be continuously optimized to better balance security and business performance.

[0090] It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowchart, in some cases the steps shown or described may be executed in a different order than that shown here.

[0091] Example 2

[0092] This application also provides a cloud platform operation and maintenance risk management device. It should be noted that this device can be used to execute the cloud platform operation and maintenance risk management method provided in this application. The following describes the cloud platform operation and maintenance risk management device provided in this application.

[0093] According to embodiments of this application, an apparatus for implementing the above-described cloud platform operation and maintenance risk management method is also provided, such as... Figure 3 As shown, the device includes: a data acquisition unit 301, an identification unit 302, a first determination unit 303, a calculation unit 304, a second determination unit 305, and an execution unit 306.

[0094] Specifically, the acquisition unit 301 is used to acquire data to be analyzed during the operation of the cloud platform, wherein the data to be analyzed includes at least the operation log information and performance index data during the operation of the cloud platform.

[0095] The identification unit 302 is used to detect anomalies in performance indicator data, identify abnormal data, and identify abnormal log information in the operation log information based on the abnormal data, wherein the abnormal log information is the log information corresponding to the abnormal data.

[0096] The first determining unit 303 is used to determine the target abnormal event based on abnormal data and abnormal log information;

[0097] The calculation unit 304 is used to calculate the similarity between the first feature vector and the second feature vector, wherein the first feature vector is a vector representation of abnormal data and abnormal log information, and the second feature vector is a vector representation of the target abnormal event.

[0098] The second determining unit 305 is used to determine whether the abnormal data belongs to the target abnormal event based on the similarity.

[0099] The execution unit 306 is used to generate a first security policy corresponding to the target abnormal event and execute the first security policy when the abnormal data belongs to the target abnormal event.

[0100] The cloud platform operation and maintenance risk management device provided in this application embodiment collects data to be analyzed during the operation of the cloud platform through a collection unit 301. The data to be analyzed includes at least operation log information and performance index data during the operation of the cloud platform. An identification unit 302 performs anomaly detection on the performance index data, identifies abnormal data, and identifies abnormal log information in the operation log information based on the abnormal data. The abnormal log information is the log information corresponding to the abnormal data. A first determination unit 303 determines a target abnormal event based on the abnormal data and abnormal log information. A calculation unit 304 calculates the similarity between a first feature vector and a second feature vector. The first feature vector is a vector representation of the abnormal data and abnormal log information, and the second feature vector is a vector representation of the target abnormal event. A second determination unit 305 determines whether the abnormal data belongs to the target abnormal event based on the similarity. If the abnormal data belongs to the target abnormal event, an execution unit 306 generates a first security policy corresponding to the target abnormal event and executes the first security policy. This solves the problem of low accuracy in detecting abnormal events in the cloud platform in related technologies, which leads to poor operation stability of the cloud platform, and achieves the effect of improving the operation stability of the cloud platform.

[0101] Optionally, in the cloud platform operation and maintenance risk management device provided in this application embodiment, the first determining unit 303 includes: an input model, used to input abnormal data and abnormal log information into a target model, wherein the target model is a model trained based on training data and the abnormal events corresponding to the training data, and the training data is known abnormal data; and an output model, used to output target abnormal events through the target model.

[0102] Optionally, in the cloud platform operation and maintenance risk management device provided in this application embodiment, the device includes: an extraction unit, used to extract abnormal feature information from abnormal data and abnormal log information before calculating the similarity between the first feature vector and the second feature vector; and a generation unit, used to generate the first feature vector based on the abnormal feature information.

[0103] Optionally, in the cloud platform operation and maintenance risk management device provided in this application embodiment, the calculation unit 304 includes: a first calculation module for calculating the vector dot product of the first feature vector and the second feature vector; a second calculation module for calculating the first vector norm of the first feature vector and the second vector norm of the second feature vector; and a third calculation module for calculating the cosine similarity between the first feature vector and the second feature vector based on the vector dot product, the first vector norm, and the second vector norm.

[0104] Optionally, in the cloud platform operation and maintenance risk management device provided in this application embodiment, the identification unit 302 includes: an identification module, used to identify abnormal data in the numerical performance indicator data, which includes performance indicator data, using the isolated forest algorithm, wherein the abnormal data is data points that deviate from a preset range.

[0105] Optionally, in the cloud platform operation and maintenance risk management device provided in this application embodiment, the device further includes: a cleaning unit, used to clean the data to be analyzed after collecting the data to be analyzed during the operation of the cloud platform, to obtain cleaned data; a conversion unit, used to perform a format conversion operation on the cleaned data, to obtain data in a unified format; and a processing unit, used to normalize the numerical data in the unified format data, to obtain preprocessed data.

[0106] Optionally, in the cloud platform operation and maintenance risk management device provided in this application embodiment, the execution unit 306 includes: a monitoring module for monitoring the execution effect of the first security policy and recording security indicator data; a fourth calculation module for calculating the reward value of the first security policy based on the security indicator data; and an adjustment module for adjusting the first security policy based on the reward value to obtain a target security policy and executing the target security policy.

[0107] It should be noted that the aforementioned acquisition unit 301, identification unit 302, first determination unit 303, calculation unit 304, second determination unit 305, and execution unit 306 correspond to steps S201 to S206 in Embodiment 1. The six units and their corresponding steps implement the same instances and application scenarios, but are not limited to the content disclosed in Embodiment 1. It should also be noted that the aforementioned modules or units can be hardware or software components stored in a memory (e.g., memory 104) and processed by one or more processors (e.g., processors 102a, 102b, ..., 102n). These modules can also run as part of a device in the computer terminal 10 provided in Embodiment 1.

[0108] Example 3

[0109] Embodiments of this application may provide a computer terminal, which may be any computer terminal device in a group of computer terminals. Optionally, in this embodiment, the aforementioned computer terminal may also be replaced with a mobile terminal or an electronic device, etc.

[0110] Optionally, in this embodiment, the computer terminal may be located in at least one of a plurality of network devices in a computer network.

[0111] In this embodiment, the aforementioned computer terminal can execute the program code for the following steps in the cloud platform operation and maintenance risk management method: collecting data to be analyzed during the operation of the cloud platform, wherein the data to be analyzed includes at least operation log information and performance index data during the operation of the cloud platform; performing anomaly detection on the performance index data, identifying abnormal data, and identifying abnormal log information in the operation log information based on the abnormal data, wherein the abnormal log information is the log information corresponding to the abnormal data; determining the target abnormal event based on the abnormal data and the abnormal log information; calculating the similarity between a first feature vector and a second feature vector, wherein the first feature vector is a vector representation of the abnormal data and the abnormal log information, and the second feature vector is a vector representation of the target abnormal event; determining whether the abnormal data belongs to the target abnormal event based on the similarity; and generating a first security policy corresponding to the target abnormal event and executing the first security policy if the abnormal data belongs to the target abnormal event.

[0112] Optionally, the aforementioned computer terminal can execute the program code for the following steps in the cloud platform's operation and maintenance risk management method: determining the target abnormal event based on abnormal data and abnormal log information includes: inputting abnormal data and abnormal log information into the target model, wherein the target model is a model trained based on training data and the abnormal events corresponding to the training data, and the training data is known abnormal data; and outputting the target abnormal event through the target model.

[0113] Optionally, the aforementioned computer terminal may execute program code for the following steps in the cloud platform's operation and maintenance risk management method: before calculating the similarity between the first feature vector and the second feature vector, the method includes: extracting abnormal feature information from abnormal data and abnormal log information; and generating the first feature vector based on the abnormal feature information.

[0114] Optionally, the aforementioned computer terminal may execute program code for the following steps in the cloud platform's operation and maintenance risk management method: calculating the similarity between the first feature vector and the second feature vector includes: calculating the vector dot product of the first feature vector and the second feature vector; calculating the first vector norm of the first feature vector and the second vector norm of the second feature vector; and calculating the cosine similarity between the first feature vector and the second feature vector based on the vector dot product, the first vector norm, and the second vector norm.

[0115] Optionally, the aforementioned computer terminal can execute the program code for the following steps in the cloud platform's operation and maintenance risk management method: performance indicator data includes numerical performance indicator data, anomaly detection is performed on the performance indicator data, and the identification of abnormal data includes: using the isolated forest algorithm to identify abnormal data in the numerical performance indicator data, wherein the abnormal data is data points that deviate from the preset range.

[0116] Optionally, the aforementioned computer terminal can execute the program code for the following steps in the cloud platform operation and maintenance risk management method: After collecting the data to be analyzed during the operation of the cloud platform, the method further includes: performing a cleaning operation on the data to be analyzed to obtain cleaned data; performing a format conversion operation on the cleaned data to obtain data in a unified format; and performing normalization processing on the numerical data in the unified format data to obtain preprocessed data.

[0117] Optionally, the aforementioned computer terminal may execute the program code for the following steps in the cloud platform's operation and maintenance risk management method: when the abnormal data is a target abnormal event, generating a first security policy corresponding to the target abnormal event and executing the first security policy includes: monitoring the execution effect of the first security policy and recording security indicator data; calculating the reward value of the first security policy based on the security indicator data; adjusting the first security policy based on the reward value to obtain the target security policy and executing the target security policy.

[0118] Optionally, Figure 4 This is a structural block diagram of an electronic device according to an embodiment of this application. Figure 4 As shown, the electronic device may include: one or more ( Figure 4 (Only one is shown) Processor 402, memory 404, memory controller, and peripheral interface, wherein the peripheral interface is connected to the radio frequency module, audio module and display.

[0119] The memory can be used to store software programs and modules, such as the program instructions / modules corresponding to the cloud platform operation and maintenance risk management method and device in this application embodiment. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory, thereby realizing the aforementioned cloud platform operation and maintenance risk management method. The memory may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory may further include memory remotely located relative to the processor, and these remote memories can be connected to the terminal via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0120] The processor can access the information and applications stored in the memory via the transmission device to execute the steps described above in the cloud platform's operation and maintenance risk management method.

[0121] This application provides a solution for cloud platform operation and maintenance risk management. By collecting data to be analyzed during the cloud platform's operation, including at least operation log information and performance indicator data, anomaly detection is performed on the performance indicator data to identify abnormal data. Based on the abnormal data, abnormal log information is identified within the operation log information, where the abnormal log information corresponds to the abnormal data. A target abnormal event is determined based on the abnormal data and abnormal log information. The similarity between a first feature vector and a second feature vector is calculated, where the first feature vector is a vector representation of the abnormal data and abnormal log information, and the second feature vector is a vector representation of the target abnormal event. The similarity determines whether the abnormal data belongs to the target abnormal event. If the abnormal data belongs to the target abnormal event, a first security policy corresponding to the target abnormal event is generated and executed. This solution addresses the technical problem of low accuracy in detecting abnormal events in the cloud platform, leading to poor operational stability of the cloud platform, and achieves the technical effect of improving the operational stability of the cloud platform.

[0122] Those skilled in the art will understand that Figure 4 The structure shown is for illustrative purposes only. Electronic devices can also be smartphones, tablets, handheld computers, mobile internet devices (MIDs), PADs, and other terminal devices. Figure 4 This does not limit the structure of the aforementioned electronic device. For example, electronic devices may also include components that are more... Figure 4 The more or fewer components shown (such as network interfaces, display devices, etc.), or having the same Figure 4 The different configurations shown.

[0123] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0124] Example 4

[0125] Embodiments of this application also provide a storage medium. Optionally, in this embodiment, the storage medium can be used to store the program code executed by the cloud platform operation and maintenance risk management method provided in Embodiment 1.

[0126] Optionally, in this embodiment, the storage medium may be located in any computer terminal in a group of computer terminals in a computer network, or in any mobile terminal in a group of mobile terminals.

[0127] Optionally, in this embodiment, the storage medium is configured to store program code for performing the following steps: collecting data to be analyzed during the operation of the cloud platform, wherein the data to be analyzed includes at least operation log information and performance index data during the operation of the cloud platform; performing anomaly detection on the performance index data, identifying abnormal data, and identifying abnormal log information in the operation log information based on the abnormal data, wherein the abnormal log information is the log information corresponding to the abnormal data; determining a target abnormal event based on the abnormal data and the abnormal log information; calculating the similarity between a first feature vector and a second feature vector, wherein the first feature vector is a vector representation of the abnormal data and the abnormal log information, and the second feature vector is a vector representation of the target abnormal event; determining whether the abnormal data belongs to the target abnormal event based on the similarity; and generating a first security policy corresponding to the target abnormal event and executing the first security policy if the abnormal data belongs to the target abnormal event.

[0128] Optionally, the storage medium is also configured to store program code for performing the following steps: inputting abnormal data and abnormal log information into the target model, wherein the target model is a model trained based on training data and the abnormal events corresponding to the training data, and the training data is known abnormal data; and outputting the target abnormal event through the target model.

[0129] Optionally, the storage medium is also configured to store program code for performing the following steps: before calculating the similarity between the first feature vector and the second feature vector, the method includes: extracting abnormal feature information from abnormal data and abnormal log information; and generating the first feature vector based on the abnormal feature information.

[0130] Optionally, the storage medium is also configured to store program code for performing the following steps: calculating the similarity between the first eigenvector and the second eigenvector includes: calculating the vector dot product of the first eigenvector and the second eigenvector; calculating the first vector norm of the first eigenvector and the second vector norm of the second eigenvector; and calculating the cosine similarity between the first eigenvector and the second eigenvector based on the vector dot product, the first vector norm, and the second vector norm.

[0131] Optionally, the storage medium is also configured to store program code for performing the following steps: performance indicator data includes numerical performance indicator data, anomaly detection is performed on the performance indicator data, and anomaly data is identified by: using the isolated forest algorithm to identify anomaly data in the numerical performance indicator data, wherein the anomaly data is data points that deviate from a preset range.

[0132] Optionally, the storage medium is also configured to store program code for performing the following steps: after collecting the data to be analyzed during the operation of the cloud platform, the method further includes: cleaning the data to be analyzed to obtain cleaned data; performing a format conversion operation on the cleaned data to obtain data in a uniform format; and normalizing the numerical data in the uniform format data to obtain preprocessed data.

[0133] Optionally, the storage medium is also configured to store program code for performing the following steps: when the abnormal data is a target abnormal event, generating a first security policy corresponding to the target abnormal event and executing the first security policy includes: monitoring the execution effect of the first security policy and recording security indicator data; calculating the reward value of the first security policy based on the security indicator data; adjusting the first security policy based on the reward value to obtain the target security policy and executing the target security policy.

[0134] This application also provides a computer program product that, when executed on a data processing device, is suitable for performing the operation and maintenance risk management method steps of a cloud platform.

[0135] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0136] In the above embodiments of this application, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0137] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection of units or modules may be electrical or other forms.

[0138] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0139] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0140] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as a USB flash drive, read-only memory (ROM), random access memory (RAM), portable hard drive, magnetic disk, or optical disk.

[0141] The above are merely preferred embodiments of this application. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A method for operation and maintenance risk management of a cloud platform, characterized in that, The method comprises: collecting to-be-analyzed data in the running process of a cloud platform, wherein the to-be-analyzed data at least includes running log information and performance index data in the running process of the cloud platform; performing anomaly detection on the performance index data, identifying abnormal data, and identifying abnormal log information in the running log information according to the abnormal data, wherein the abnormal log information is log information corresponding to the abnormal data; determining a target abnormal event based on the abnormal data and the abnormal log information; calculating the similarity of a first feature vector and a second feature vector, wherein the first feature vector is a vector representation of the abnormal data and the abnormal log information, and the second feature vector is a vector representation of the target abnormal event; determining whether the abnormal data belongs to the target abnormal event according to the similarity; generating a first security policy corresponding to the target abnormal event and executing the first security policy in the case that the abnormal data belongs to the target abnormal event.

2. The method of claim 1, wherein, Determining a target abnormal event based on the abnormal data and the abnormal log information comprises: inputting the abnormal data and the abnormal log information into a target model, wherein the target model is a model trained based on training data and an abnormal event corresponding to the training data, and the training data is known abnormal data; outputting the target abnormal event through the target model.

3. The method of claim 1, wherein, Before calculating the similarity of the first feature vector and the second feature vector, the method comprises: extracting abnormal feature information in the abnormal data and the abnormal log information; generating the first feature vector according to the abnormal feature information.

4. The method of claim 2, wherein, Calculating the similarity of the first feature vector and the second feature vector comprises: calculating the vector dot product of the first feature vector and the second feature vector; calculating the first vector norm of the first feature vector and the second vector norm of the second feature vector; calculating the cosine similarity of the first feature vector and the second feature vector according to the vector dot product, the first vector norm, and the second vector norm.

5. The method of claim 1, wherein, The performance index data includes numerical performance index data, and performing anomaly detection on the performance index data to identify abnormal data comprises: identifying the abnormal data in the numerical performance index data using an isolation forest algorithm, wherein the abnormal data is a data point deviating from a preset range.

6. The method of claim 1, wherein, After collecting the to-be-analyzed data in the running process of the cloud platform, the method further comprises: performing a cleaning operation on the to-be-analyzed data to obtain cleaned data; performing a format conversion operation on the cleaned data to obtain data in a unified format; performing normalization processing on numerical data in the data in the unified format to obtain preprocessed data.

7. The method of claim 1, wherein, In the case that the abnormal data is a target abnormal event, generating a first security policy corresponding to the target abnormal event and executing the first security policy comprises: monitoring the execution effect of the first security policy and recording security index data; calculating the reward value of the first security policy according to the security index data; Adjust the first security policy according to the reward value to obtain a target security policy, and execute the target security policy.

8. An operation and maintenance risk management apparatus of a cloud platform, characterized by comprising: The method comprises the steps of: The acquisition unit is configured to acquire to-be-analyzed data in a cloud platform running process, wherein the to-be-analyzed data at least includes running log information and performance index data in the cloud platform running process. The identification unit is configured to perform abnormality detection on the performance index data, identify abnormal data, and identify abnormal log information in the running log information according to the abnormal data, wherein the abnormal log information is log information corresponding to the abnormal data. The first determination unit is configured to determine a target abnormal event based on the abnormal data and the abnormal log information. The calculation unit is configured to calculate a similarity between a first feature vector and a second feature vector, wherein the first feature vector is a vector representation of the abnormal data and the abnormal log information, and the second feature vector is a vector representation of the target abnormal event. The second determination unit is configured to determine whether the abnormal data belongs to the target abnormal event according to the similarity. The execution unit is configured to generate a first security policy corresponding to the target abnormal event and execute the first security policy in a case where the abnormal data belongs to the target abnormal event.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium comprises a stored executable program, wherein the executable program controls a device where the computer readable storage medium is located to execute the cloud platform operation and maintenance risk management method in any one of claims 1 to 7 when the executable program is running.

10. An electronic device, comprising: The method comprises the steps of: The memory stores an executable program; The processor is configured to run the program, wherein the program executes the cloud platform operation and maintenance risk management method in any one of claims 1 to 7 when the program is running.

11. A computer program product comprising computer instructions, characterized in that, The computer instructions are executed by the processor to implement the steps of the cloud platform operation and maintenance risk management method in any one of claims 1 to 7.

Images